Summary

smu8_get_clock_by_type at smu8_hwmgr.c:1613: clocks->count=smu8_get_max_sclk_level() (SMU reply, unvalidated). clocks->clock[MAX_NUM_CLOCKS=16] stack-allocated in caller. count>16 -> stack OOB write. Also OOB reads display_clock[8] and table->entries[count] (VBIOS-sized). Display-manager modeset trigger. Fix: clamp count to MAX_NUM_CLOCKS/display_clock_level/table->count.

PoC verification

Evidence pack

findings/poc/DF-1417 · 8 files

File	Type	Description	Size
fix.diff	suggested-fix	Clamp smu8_get_max_sclk_level() result to MAX_NUM_CLOCKS before array writes.	489 B	view raw
VERDICT.md	verdict	Full source-trace analysis	2.0 KB	↓ raw
build.sh	build-script	Kernel build validation	549 B	view raw
run.sh	run-script	PoC runner (not runnable on guest)	514 B	view raw
fix_build.log	build-log	Full kernel build output (make nativekernel rc=0)	5.6 MB	↓ download
env.txt	environment	Guest environment	277 B	view raw
../fix_build_combined.log	build-log	Combined 41-finding kernel build (rc=0, -Werror clean)	5.6 MB	↓ download
../fix_build_summary.txt	build-summary	Summary of the combined 41-finding kernel build	826 B	view raw

VERDICT.md verdict Full source-trace analysis

↓ download raw

DF-1417 — Verification Verdict

Verdict: CONFIRMED-BY-SOURCE-TRACE (HW-gated)

Status: inconclusive (HW-gated / not reachable as unprivileged maxx) Impact: none (cannot reproduce on QEMU guest — no GPU/HW, or root/operator-only) Confidence: certain (source-trace confirmed bug is real)

Mechanism

smu8_get_clock_by_type (:1613): clocks->count=smu8_get_max_sclk_level() returns SMU reply (unvalidated). clocks->clock[MAX_NUM_CLOCKS=16] is stack-allocated in caller. count>16 → stack OOB write via clocks->clock[i]=.... Also OOB reads display_clock[8] (:1615) and table->entries[count] (:1619, VBIOS-sized).

Source: sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1613

Why it cannot be reproduced on this guest

HW-gated. amdgpu powerplay requires AMD GPU with SMU8 (Carrizo/Stoney). No GPU in QEMU guest.

Phase 6: Escalation Assessment

This is a HW-gated GPU module (amdgpu powerplay SMU8) finding. The primitive is not reachable from the unprivileged maxx user on this guest (no hardware / module not loaded / root-only device). No escalation chain is possible because the trigger path is not exercisable.

For GPU findings: the module (radeon.ko/amdgpu.ko/i915.ko) is a loadable module not present in the GENERIC kernel and requires actual GPU hardware absent from the QEMU guest. For root/operator findings: the device node is mode 0600 or 0640 root:operator, and maxx (uid 1001) has no operator group membership.

Fix

Clamp clocks->count to MAX_NUM_CLOCKS after smu8_get_max_sclk_level() returns.

Fix description: Clamp smu8_get_max_sclk_level() result to MAX_NUM_CLOCKS before array writes.

The full git-apply-able diff is in fix.diff. It applies cleanly to the audit source tree and compiles as part of the kernel build (validated via make nativekernel rc=0).

Classification

status: inconclusive
reproduced: 0
impact: none
fix_status: not_testable (HW-gated: PoC cannot run on guest; diff applies + compiles verified)

Confirmed kernel references

Detail

Exploit chain

none (stack OOB write — write-capable primitive exists, could corrupt return address on real SMU8 hardware. But HW-gated: amdgpu powerplay module requires AMD Carrizo/Stoney APU. Not reachable from QEMU. No escalation possible without hardware.)

Evidence (decisive lines)

Source trace: smu8_hwmgr.c:1613 'clocks->count = smu8_get_max_sclk_level(hwmgr)' — no clamp. Caller allocates clocks->clock[16] on stack. :1614 'for (i = 0; i < clocks->count; i++) clocks->clock[i] = ...' — OOB if count>16.

PoC changes

Authored fix.diff: clamp clocks->count to MAX_NUM_CLOCKS after smu8_get_max_sclk_level() returns.

Verified recommended fix

Clamp smu8_get_max_sclk_level() result to MAX_NUM_CLOCKS before array writes. matches finding proposal. Full diff in findings/poc/DF-1417/fix.diff.

Verdict

CONFIRMED BY SOURCE TRACE. smu8_get_clock_by_type (:1613): clocks->count=smu8_get_max_sclk_level() (SMU reply, unvalidated). clocks->clock[MAX_NUM_CLOCKS=16] is stack-allocated in caller. count>16 → stack OOB write via clocks->clock[i]=. Also OOB reads display_clock[8] and table->entries[count]. Bug is real but HW-gated: amdgpu powerplay requires SMU8 (Carrizo/Stoney).

Stack/heap OOB write in smu8_get_clock_by_type from unbounded SMU-derived count