⬢ DragonFlyBSD Kernel Audit
DF-4811 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
{
  "finding_id": "DF-4811",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Static-proven off-by-one: aps.c allocates a 0x1f-byte I/O window (0x1600-0x161E) but every aps_do_io() transaction reads/writes port 0x1600+0x1f=0x161F (aps.c:193,210-215,233-238), one past the rman allocation. Not runtime-verified: the QEMU guest has no H8S EC at 0x1600 so the driver never attaches, and Info-severity hardware-gated findings are skipped per audit contract. No kernel-memory impact; fix is the one-line window size 0x1f->0x20.",
  "exploit_chain": "",
  "evidence": "README.md The bug section (arithmetic at aps.c:101-102 vs :61,:193,:210-215,:233-238); VERDICT.md Static proof steps 1-5; fix.diff",
  "kernel_refs": [
    "sys/dev/powermng/aps/aps.c:102",
    "sys/dev/powermng/aps/aps.c:61",
    "sys/dev/powermng/aps/aps.c:193",
    "sys/dev/powermng/aps/aps.c:210",
    "sys/dev/powermng/aps/aps.c:215",
    "sys/dev/powermng/aps/aps.c:238",
    "sys/dev/powermng/aps/aps.c:284"
  ],
  "poc_changes": "n/a \u2014 no seed PoC; finding derived during pass-2 audit",
  "attempts": 0,
  "guest_uname": "n/a (not exercised: Info severity, hardware-gated; guest has no ThinkPad H8S EC)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable: fix validation requires real ThinkPad APS EC hardware (or an LPC device model the guest lacks); the one-line fix is a static derivation",
  "fix_evidence": "fix.diff (APS_ADDR_SIZE 0x1f -> 0x20, unapplied, authored against read-only sys/)",
  "notes": "Inherited from OpenBSD aps.c rev 1.19 (header aps.c:1). Driver optional: sys/conf/files:2600, commented in GENERIC sys/config/X86_64_GENERIC:178, hint in LINT64:1677. Impact ceiling: hygiene; constant 0x01 write + reads at one fixed port outside rman window; requires root to load the driver.",
  "recommended_fix": "Widen the allocated I/O window to match the 16-register TWR file the driver touches: #define APS_ADDR_SIZE 0x20 in sys/dev/powermng/aps/aps.c"
}