⬢ DragonFlyBSD Kernel Audit
DF-5782 / verdict.json
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
{
  "finding_id": "DF-5782",
  "status": "untested",
  "reproduced": false,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Vendored-v4.20 i915 lacks upstream 70bbe53c6eac: intel_fb_offset_to_xy() (intel_display.c:2398) has no driver-side u32-overflow guard for tile-aligned height*pitch+offsets[], so a crafted NV12/CCS ADDFB2 (unauthenticated ioctl per drm_ioctl.c:671) wraps the offset/size math in intel_compute_aligned_offset (:2360) and intel_fill_fb_info (:2635), defeating the final bo-size check (:2643) and enabling OOB GPU scanout reads past the objects GGTT mapping (info-leak-class to the display; upstream authors stated worst case). Proven by whole-file differential against upstream v4.20 (file is v4.20 + KPI shims + 2 backports) and by the upstream fix hunk; NOT executed because the audit rig has Bochs VGA only (no i915 attach) \u2014 code-reading + differential verification per task instructions.",
  "exploit_chain": "open /dev/dri/card0 (no auth/master needed) -> DRM_IOCTL_MODE_ADDFB2 with NV12 (gen9 KBL/CFL/GLK/CNL) or CCS modifier, 8192-wide tiled geometry, offsets[1] near 2^32 -> core drm_framebuffer.c:208 check passes (raw height) -> driver tile-aligns height and wraps u32 products in intel_fb_offset_to_xy/intel_compute_aligned_offset/intel_fill_fb_info -> mul_u32_u32 final check fooled -> fb registered with size smaller than true extent -> when displayed, display engine scans out past object end into adjacent GGTT mappings (upstream igt: kms_big_fb/x-tiled-addfb-size-offset-overflow).",
  "evidence": "VERDICT.md (full chain with path:line); differential/upstream_4.20_to_v5.1.fb_overflow_hunk.txt (the exact missing guard); differential/dfly_vs_v4.20.full.diff (proves base == upstream v4.20, no DFly semantic divergence); addfb2_offset_overflow.c (trigger source); env.txt (Bochs-only rig).",
  "kernel_refs": [
    "sys/dev/drm/i915/intel_display.c:2398",
    "sys/dev/drm/i915/intel_display.c:2360",
    "sys/dev/drm/i915/intel_display.c:2635",
    "sys/dev/drm/i915/intel_display.c:2643",
    "sys/dev/drm/i915/intel_display.c:14690",
    "sys/dev/drm/i915/intel_display.c:14706",
    "sys/dev/drm/drm_ioctl.c:671",
    "sys/dev/drm/drm_framebuffer.c:205"
  ],
  "poc_changes": "n/a \u2014 trigger authored fresh for this pack (ADDFB2 ioctl, card discovery, crafted NV12/X-tiled geometry with offsets[1] near 2^32); could not be compiled against an i915 device on this rig.",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64 (QEMU, Bochs VGA 0x1234:1111, no i915)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o /tmp/addfb2_offset_overflow addfb2_offset_overflow.c",
  "run_cmd": "/tmp/addfb2_offset_overflow",
  "code_hash": "2ae2ee2773de5a77223f38961f616ccc72de4924b2986daf5107fa29f9a0d329",
  "notes": "Upstream commits establishing the bug/fix pair: 70bbe53c6eac (missing guard, landed v5.0) and 4e05047d3e00 (mul_u32_u32 half, already present in v4.20 \u2014 checked and NOT double-reported). Only plane>=1 offsets usable (offsets[0]==0 enforced at intel_display.c:14706). NV12 allowed only on gen9 non-SKL/BXT and <gen11 per intel_framebuffer_init:14690-14698; CCS needs SKL+.",
  "recommended_fix": "Backport upstream 70bbe53c6eac: reject fbs whose tile-aligned height*pitch+offsets[color_plane] exceeds u32 in intel_fb_offset_to_xy() (fix.diff).",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": false,
  "fix_patched_reproduced": false,
  "fix_verdict": "fix.diff is a faithful standalone backport of upstream 70bbe53c6eac (explicit u64 math instead of add_overflows_t, which this tree lacks). Not built/tested: no Intel GPU on the rig, so baseline and patched kernels are both non-executable here; upstream igt kms_big_fb/*-addfb-size-offset-overflow covers both directions on real hardware.",
  "fix_evidence": "fix.diff; differential/upstream_4.20_to_v5.1.fb_overflow_hunk.txt; upstream commit 70bbe53c6eac message (framebuffer_check() in the core already does the same check, but as it doesnt know about tiling some things can slip through)."
}