⬢ DragonFlyBSD Kernel Audit
DF-4665 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{
  "finding_id": "DF-4665",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Harness-verified on the DragonFly 6.5-DEVELOPMENT guest using the verbatim kernel function and 1:1 struct layouts (no AMD GPU on the audit guest; methodology identical to DF-3683/DF-3686): smu_get_voltage_dependency_table_ppt_v1 has no destination-size parameter and copies allowed_dep_table->count (raw VBIOS ucNumEntries, up to 255) 28-byte records into callers fixed entries[MAX_REGULAR_DPM_NUMBER=8] tables. The smu7 call path (smu7_odn_initial_default_setting, reached at driver load with OverDrive enabled and via PP_OD_RESTORE_DEFAULT_TABLE sysfs) overflows struct smu7_hwmgr: with count=16 and only 2 distinct clocks the already-filed DF-1166 dedup site stays in bounds while this copy writes 224 attacker-controlled bytes OOB (vdd_dependency_on_mclk.count corrupted to a VBIOS clk value); with count=255 it writes 6916 bytes past entries[7], 6420 past the backend-shaped allocation, 55/64 canary words smashed. Patched twin (fix.diff clamp) shows zero corruption.",
  "exploit_chain": "crafted VBIOS / VFIO pp_table / root sysfs pp_table on smu7 board (Tonga/Fiji/Polaris10/VegaM) with od_enabled -> smu7_setup_default_dpm_tables:967 -> smu7_odn_initial_default_setting -> smu_get_voltage_dependency_table_ppt_v1(dep_sclk_table, &odn_table->vdd_dependency_on_sclk) -> linear heap overflow inside and past struct smu7_hwmgr with fully attacker-controlled 28-byte records (up to 6916 bytes past entries[7]) -> kernel heap corruption of adjacent slab objects; deterministic panic at minimum, potential code execution with slab grooming.",
  "evidence": "findings/poc/DF-4665/run.log: baseline count=255 section shows OOB bytes past entries[7] : 6916, past end of backend-like object: 6420, canary words ... smashed: 55/64, OOB-WRITE CONFIRMED; count=16/2-distinct section shows DF-1166 site IN BOUNDS while vdd_dependency_on_mclk.count is corrupted (novelty vs DF-1166); patched-twin sections show FIX VALIDATED.",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:675-699",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:844-857",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:962-968",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.h:177-190",
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:436"
  ],
  "poc_changes": "Seed harness authored fresh for this finding (no prior seed): verbatim smu_helper.c:675-699 body + 1:1 struct layouts from hwmgr_ppt.h/hardwaremanager.h/smu7_hwmgr.h; canary-guarded struct-smu7_hwmgr-prefix buffer; DF-1166 dedup site replicated first to prove the new bug fires where the known one does not.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 420,
  "guest_dirty": 0,
  "build_cmd": "cc -O0 -g -Wall -o smu7_odn_overflow smu7_odn_overflow.c && cc -O0 -g -Wall -o smu7_odn_overflow_patched smu7_odn_overflow_patched.c",
  "run_cmd": "sh run.sh",
  "code_hash": "a54ed6a745ea62df501a07d15581648012b675d8cadd43f6d9be69888d38d679",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Patched-twin harness (function carrying the fix.diff clamp, call site passing MAX_REGULAR_DPM_NUMBER) shows stored count clamped to 8, vdd_dependency_on_mclk intact, 0/64 canaries damaged for count=16 and count=255 \u2014 the out-of-bounds write is gone. Full kernel rebuild not performed: no AMD GPU exists on the audit guest, so the verbatim-function harness is the faithful validation surface (same methodology as DF-3683).",
  "fix_evidence": "findings/poc/DF-4665/run.log patched twin sections: FIX VALIDATED: no out-of-bounds writes with clamped copy (count=16 and count=255).",
  "notes": "vega10 leg of this helper is DF-3703 (not re-filed); the uint8_t loop counter wrap in the same function is DF-1799 (fixed as a side effect by the uint32_t i in fix.diff). Hardware prerequisite keeps realistic severity at High, consistent with DF-1166/DF-1797/DF-3703.",
  "recommended_fix": "Pass destination capacity (max_entries) to smu_get_voltage_dependency_table_ppt_v1 and clamp the copy; callers pass MAX_REGULAR_DPM_NUMBER."
}