⬢ DragonFlyBSD Kernel Audit
DF-4863 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
{
  "finding_id": "DF-4863",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Harness-verified on the DragonFly 6.5-DEVELOPMENT guest (scenario [4] of the DF-4862 verbatim-function harness, 1:1 struct layouts enforced by _Static_assert): amdgpu_cgs.c:214-215 indexes adev->firmware.ucode[] with fw_type_convert()s return without any bound check, and that helpers DEFAULT return is AMDGPU_UCODE_ID_MAXIMUM == 21 == the array size. Runtime proof: &ucode[MAXIMUM].fw == &firmware.fw_buf (ALIAS CONFIRMED) - the OOB read fetches the amdgpu_bo* fw_buf field; with fw_buf non-NULL (its state after amdgpu_ucode_init_bo, which smu7_request_smu_load_fw calls first) the NULL guard passes and the verbatim code reinterprets amdgpu_bo internals as struct firmware, dereferencing ->data (sys/sys/firmware.h:53) and propagating garbage (image_size=0x5a5a5a5a) to the caller - on real hardware a wild read, panic class. Reachability is LATENT: every in-tree caller (smu7/smu8/ci/iceland/vega10/12/20 smumgrs) passes only mapped types today; the enum already ships an unmapped value (CGS_UCODE_ID_GMCON_RENG). Patched twin rejects the one-past-end index with -EINVAL (FIX VALIDATED); 3/3 deterministic runs.",
  "exploit_chain": "",
  "evidence": "findings/poc/DF-4863/run.log scenario [4]: &firmware.ucode[MAXIMUM].fw = 0x403758  == &firmware.fw_buf = 0x403758  : ALIAS CONFIRMED; baseline cgs_get_firmware_info(CGS_UCODE_ID_GMCON_RENG) = 0 with type-confused header=bo+8 -> image_size=0x5a5a5a5a version=0x5a5a propagated to caller; patched twin -22 (one-past-end index rejected - FIX VALIDATED). Compile-time proof in cgs_mec_jt_oob.c (_Static_assert(offsetof(amdgpu_firmware, fw_buf) == MAXIMUM*48+8)).",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_cgs.c:214-215",
    "sys/dev/drm/amd/amdgpu/amdgpu_cgs.c:111-156",
    "sys/dev/drm/amd/amdgpu/amdgpu_ucode.h:252-268",
    "sys/dev/drm/amd/amdgpu/amdgpu_ucode.h:187-210",
    "sys/dev/drm/amd/include/cgs_common.h:46-63",
    "sys/sys/firmware.h:51-56"
  ],
  "poc_changes": "No separate PoC authored: the defect is demonstrated by scenario [4] of the DF-4862 harness built in the same run (same verbatim cgs function, same struct replicas); this pack carries the same sources and the scenario-[4]-focused logs/verdicts.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "sh build.sh  (cc -O0 -g -Wall -o cgs_mec_jt_oob cgs_mec_jt_oob.c; cc -O0 -g -Wall -o cgs_mec_jt_oob_patched cgs_mec_jt_oob_patched.c)",
  "run_cmd": "sh run.sh   (scenario [4])",
  "code_hash": "16a0787bb19af20dc874ccd3096b84f344608a083ed4127c6416fdfd8a4938a2",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Patched twin adds if (id >= AMDGPU_UCODE_ID_MAXIMUM) return -EINVAL; before the ucode[] indexing (fix.diff, same patch as DF-4862): the one-past-end call returns -22 before any OOB element read, while all mapped-type scenarios behave identically. Full kernel rebuild not performed (no AMD GPU on the audit guest; verbatim-function harness is the faithful surface).",
  "fix_evidence": "findings/poc/DF-4863/run.log patched-twin scenario [4]: cgs_get_firmware_info(CGS_UCODE_ID_GMCON_RENG) = -22 (one-past-end index rejected - FIX VALIDATED).",
  "notes": "Latent reachability (no in-tree caller passes an unmapped type; GMCON_RENG exists unhandled in the enum) - filed Low/hardening. Companion finding DF-4862 (same function, CP_MEC branch) is live.",
  "recommended_fix": "Range-check fw_type_convert()s return before indexing: if (id >= AMDGPU_UCODE_ID_MAXIMUM) return -EINVAL; at amdgpu_cgs.c:214 (fix.diff)."
}