⬢ DragonFlyBSD Kernel Audit
DF-4927 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
{
  "finding_id": "DF-4927",
  "title": "radeon_sa_bo_next_hole dangling fence pointers -> UAF + double free in radeon_sa_bo_new (missing upstream 0381ac3ca2e7 fix)",
  "verdict": "inconclusive_kernel__logic_reproduced",
  "impact_assessed": "kernel heap UAF/double-free, unprivileged DRI client on radeon HW (High)",
  "impact_observed_on_guest": "none (guest has no radeon GPU; kernel path not exercisable)",
  "reproduce": {
    "build": "sh build.sh   (cc -O2 -> rsa_base; cc -O2 -DFIXED -> rsa_fixed)",
    "run": "sh run.sh",
    "expected": "rsa_base exits 42 printing UAF-REF/UAF-WAIT/DOUBLE-FREE at sa.c:352/356/358; rsa_fixed exits 0 with zero events"
  },
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_sa.c:278",
    "sys/dev/drm/radeon/radeon_sa.c:270-272",
    "sys/dev/drm/radeon/radeon_sa.c:335-338",
    "sys/dev/drm/radeon/radeon_sa.c:150",
    "sys/dev/drm/radeon/radeon_sa.c:166",
    "sys/dev/drm/radeon/radeon_sa.c:306",
    "sys/dev/drm/radeon/radeon_sa.c:352-353",
    "sys/dev/drm/radeon/radeon_sa.c:356",
    "sys/dev/drm/radeon/radeon_sa.c:357-358",
    "sys/dev/drm/radeon/radeon_fence.c:699-715",
    "sys/dev/drm/radeon/radeon_fence.c:1114-1120",
    "sys/dev/drm/linux_fence.c:43-51",
    "sys/dev/drm/include/linux/dma-fence.h:90-110",
    "sys/dev/drm/radeon/radeon_ib.c:95-98"
  ],
  "upstream_refs": [
    "Linux 0381ac3ca2e7 drm/radeon: Initialize fences array entries in radeon_sa_bo_next_hole",
    "Linux 6a15f3ff19a8 drm/amdgpu: Initialize fences array entries in amdgpu_sa_bo_next_hole",
    "Linux f6ff4f67cdf8 drm/radeon: hold reference to fences in radeon_sa_bo_new (present in DF)"
  ],
  "artifacts": [
    "radeon_sa_uaf.c", "build.sh", "run.sh", "build.log", "run.log",
    "run.2.log", "run.3.log", "env.txt", "fix.diff", "VERDICT.md",
    "README.md", "manifest.json", "verdict.json"
  ]
}