⬢ DragonFlyBSD Kernel Audit
DF-5224 / manifest.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
{
  "finding_id": "DF-5224",
  "file": "sys/dev/drm/amd/display/dc/bios/bios_parser_helper.c",
  "verdict": "untested",
  "impact": "none",
  "confidence": "speculative",
  "severity": "Info",
  "class": "hardening / latent integer wrap (CWE-190) at the DC atombios image-bounds helper",
  "reproduce": {
    "build": "n/a — source-level verification only",
    "run": "./verify.sh (mechanical caller-bounds audit backing the negative reachability claim); git apply --check fix.diff",
    "expected": "run.log shows every GET_IMAGE/bios_get_image caller offset bounded by two uint16_t table fields (max ~0x1FFFE) and sizes <= ~4KB or <=510 (64-bit computed), so offset+size cannot wrap uint32; fix.diff applies cleanly"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/display/dc/bios/bios_parser_helper.c:36",
    "sys/dev/drm/amd/display/dc/bios/bios_parser_helper.c:40",
    "sys/dev/drm/amd/display/dc/bios/bios_parser_helper.h:39",
    "sys/dev/drm/amd/display/dc/bios/bios_parser.c:2878",
    "sys/dev/drm/amd/display/dc/bios/bios_parser.c:2022",
    "sys/dev/drm/amd/display/dc/bios/bios_parser2.c:1930",
    "sys/dev/drm/amd/include/atomfirmware.h:381",
    "sys/dev/drm/amd/amdgpu/Makefile:208"
  ],
  "non_duplicates": ["DF-4168 (bios_size provenance, bios_parser2.c:1930)", "DF-3942 (caller NULL-deref)", "DF-1299 (caller flex-count OOB)"],
  "artifacts": ["README.md", "VERDICT.md", "verify.sh", "run.log", "fix.diff", "manifest.json", "verdict.json"],
  "audited_pass": 2
}