⬢ DragonFlyBSD Kernel Audit
DF-4635 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-4635",
  "title": "radeon_audio: enc_priv type confusion (radeon_encoder_lvds* used as radeon_encoder_atom_dig*) on LCD-carrying digital encoders (eDP) -> dig->pin/dig->afmt OOB read/write into the ADJACENT slab chunk (280B alloc, 288B chunk, accesses at +288/+296) + wild MMIO deref",
  "verdict": "inconclusive",
  "impact_class": "heap OOB read/write (memcorrupt), hardware-gated trigger",
  "reproduce": {
    "build": "on guest: cc -O -o radeon_audio_offsets radeon_audio_offsets.c && make -f Makefile SYSDIR=/usr/src/sys (see build.sh)",
    "run": "on guest: ./radeon_audio_offsets; kldload ./aflvds.ko; dmesg | grep aflvds (see run.sh)",
    "expected": "offsets lvds=280 afmt=288 pin=296; KLD shows usable chunk 288, adjacent pair stride 288, OOB read at +296 returns neighbor bytes, OOB write at +296 zeroes neighbor [8..16)"
  },
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_audio.c:444-486",
    "sys/dev/drm/radeon/radeon_audio.c:459",
    "sys/dev/drm/radeon/radeon_audio.c:475-484",
    "sys/dev/drm/radeon/radeon_audio.c:263-268",
    "sys/dev/drm/radeon/radeon_audio.c:548-551",
    "sys/dev/drm/radeon/radeon_audio.c:632-643",
    "sys/dev/drm/radeon/atombios_encoders.c:2860-2872",
    "sys/dev/drm/radeon/radeon_encoders.c:423-445",
    "sys/dev/drm/radeon/radeon_connectors.c:1765-1768",
    "sys/dev/drm/radeon/radeon_connectors.c:2264-2268",
    "sys/dev/drm/radeon/radeon_connectors.c:1851-1858",
    "sys/dev/drm/radeon/radeon_mode.h:381-396",
    "sys/dev/drm/radeon/radeon_mode.h:427-442",
    "sys/kern/kern_slaballoc.c:638"
  ],
  "artifacts": [
    "README.md", "VERDICT.md",
    "radeon_audio_offsets.c", "aflvds.c",
    "build.sh", "run.sh",
    "build.log", "run.log", "fix_build.log",
    "env.txt", "fix.diff",
    "manifest.json", "verdict.json"
  ]
}