Summary

cik_get_register_value at cik.c:1032-1043: se_idx/sh_idx from user ioctl AMDGPU_INFO_READ_MMR_REG (masked 0xff, range 0-254). rb_config[4][2] array. No bounds check. se_idx>=4 or sh_idx>=2 -> OOB read of kernel heap past amdgpu_gfx_config. Each 4B value returned to user via AMDGPU_INFO ioctl (DRM_AUTH|DRM_RENDER_ALLOW). KASLR bypass + heap leak. CIK hardware (Bonaire/Hawaii/Kaveri). Sibling in vi.c. Fix: check se_idx<AMDGPU_GFX_MAX_SE && sh_idx<AMDGPU_GFX_MAX_SH_PER_SE.

PoC verification

Evidence pack

findings/poc/DF-1403 · 8 files

File	Type	Description	Size
fix.diff	suggested-fix	Add bounds check se_idx < AMDGPU_GFX_MAX_SE && sh_idx < AMDGPU_GFX_MAX_SH_PER_SE before rb_config[][] access.	505 B	view raw
VERDICT.md	verdict	Full source-trace analysis	2.1 KB	↓ raw
build.sh	build-script	Kernel build validation	533 B	view raw
run.sh	run-script	PoC runner (not runnable on guest)	490 B	view raw
fix_build.log	build-log	Full kernel build output (make nativekernel rc=0)	5.6 MB	↓ download
env.txt	environment	Guest environment	277 B	view raw
../fix_build_combined.log	build-log	Combined 41-finding kernel build (rc=0, -Werror clean)	5.6 MB	↓ download
../fix_build_summary.txt	build-summary	Summary of the combined 41-finding kernel build	826 B	view raw

VERDICT.md verdict Full source-trace analysis

↓ download raw

DF-1403 — Verification Verdict

Verdict: CONFIRMED-BY-SOURCE-TRACE (HW-gated)

Status: inconclusive (HW-gated / not reachable as unprivileged maxx) Impact: none (cannot reproduce on QEMU guest — no GPU/HW, or root/operator-only) Confidence: certain (source-trace confirmed bug is real)

Mechanism

cik_get_register_value (:1032-1043): se_idx/sh_idx from user ioctl AMDGPU_INFO_READ_MMR_REG (masked 0xff, range 0-254). rb_config[4][2] array (AMDGPU_GFX_MAX_SE=4, AMDGPU_GFX_MAX_SH_PER_SE=2). No bounds check. se_idx>=4 or sh_idx>=2 → OOB read of kernel heap past amdgpu_gfx_config. Each 4B value returned to user via AMDGPU_INFO ioctl (DRM_AUTH|DRM_RENDER_ALLOW). KASLR bypass + heap leak. Same bug exists in vi.c.

Source: sys/dev/drm/amd/amdgpu/cik.c:1032-1043

Why it cannot be reproduced on this guest

HW-gated. amdgpu.ko requires CIK hardware (Bonaire/Hawaii/Kaveri). No AMD GPU in QEMU guest.

Phase 6: Escalation Assessment

This is a HW-gated GPU module (amdgpu CIK) finding. The primitive is not reachable from the unprivileged maxx user on this guest (no hardware / module not loaded / root-only device). No escalation chain is possible because the trigger path is not exercisable.

For GPU findings: the module (radeon.ko/amdgpu.ko/i915.ko) is a loadable module not present in the GENERIC kernel and requires actual GPU hardware absent from the QEMU guest. For root/operator findings: the device node is mode 0600 or 0640 root:operator, and maxx (uid 1001) has no operator group membership.

Fix

Check se_idx < AMDGPU_GFX_MAX_SE && sh_idx < AMDGPU_GFX_MAX_SH_PER_SE before array access.

Fix description: Add bounds check se_idx < AMDGPU_GFX_MAX_SE && sh_idx < AMDGPU_GFX_MAX_SH_PER_SE before rb_config[][] access.

The full git-apply-able diff is in fix.diff. It applies cleanly to the audit source tree and compiles as part of the kernel build (validated via make nativekernel rc=0).

Classification

status: inconclusive
reproduced: 0
impact: none
fix_status: not_testable (HW-gated: PoC cannot run on guest; diff applies + compiles verified)

Confirmed kernel references

Detail

Exploit chain

none (OOB read / heap info leak primitive — read-only, returns 4B per call to user via AMDGPU_INFO ioctl. Would be an unprivileged info leak on real CIK hardware with DRM_RENDER_ALLOW. HW-gated on this guest.)

Evidence (decisive lines)

Source trace: cik.c:1037 'adev->gfx.config.rb_config[se_idx][sh_idx].rb_backend_disable' — no bounds check. amdgpu_gfx.h:179 'rb_config[AMDGPU_GFX_MAX_SE][AMDGPU_GFX_MAX_SH_PER_SE]' = [4][2].

PoC changes

Authored fix.diff: add bounds check se_idx >= AMDGPU_GFX_MAX_SE || sh_idx >= AMDGPU_GFX_MAX_SH_PER_SE before rb_config[][] access.

Verified recommended fix

Add bounds check se_idx < AMDGPU_GFX_MAX_SE && sh_idx < AMDGPU_GFX_MAX_SH_PER_SE before array access. matches finding proposal. Full diff in findings/poc/DF-1403/fix.diff.

Verdict

CONFIRMED BY SOURCE TRACE. cik_get_register_value (:1032-1043): se_idx/sh_idx from user ioctl AMDGPU_INFO_READ_MMR_REG (masked 0xff, range 0-254). rb_config[AMDGPU_GFX_MAX_SE=4][AMDGPU_GFX_MAX_SH_PER_SE=2]. No bounds check. se_idx>=4 or sh_idx>=2 → OOB read past amdgpu_gfx_config. Each 4B value returned to user (info leak). Bug is real but HW-gated: amdgpu.ko requires CIK hardware (Bonaire/Hawaii/Kaveri). No AMD GPU in QEMU.

Unprivileged OOB read / kernel memory leak in cik_get_register_value via attacker-controlled SE/SH index