OOB read of vddc_dependency_on_sclk via clock_info_index clamped to wrong bound
Summary
smu8_dpm_get_pp_table_entry_callback at smu8_hwmgr.c:1350-1356: clock_info_index clamped to hardwareActivityPerformanceLevels-1 (=7) but indexes table->entries[] where table->count is VBIOS ucNumEntries (may be <8). index>=count -> OOB heap read. Value programmed to SMU and returned via performance_level. Sibling of DF-1309. Fix: clamp to min(table->count-1, hwLevels-1).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1418 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Additionally clamp clock_info_index to table->count-1 after the hwLevels clamp. | 682 B | view raw |
| VERDICT.md | verdict | Full source-trace analysis | 2.0 KB | ↓ raw |
| build.sh | build-script | Kernel build validation | 549 B | view raw |
| run.sh | run-script | PoC runner (not runnable on guest) | 480 B | view raw |
| fix_build.log | build-log | Full kernel build output (make nativekernel rc=0) | 5.6 MB | ↓ download |
| env.txt | environment | Guest environment | 277 B | view raw |
| ../fix_build_combined.log | build-log | Combined 41-finding kernel build (rc=0, -Werror clean) | 5.6 MB | ↓ download |
| ../fix_build_summary.txt | build-summary | Summary of the combined 41-finding kernel build | 826 B | view raw |
DF-1418 — Verification Verdict
Verdict: CONFIRMED-BY-SOURCE-TRACE (HW-gated)
Status: inconclusive (HW-gated / not reachable as unprivileged maxx) Impact: none (cannot reproduce on QEMU guest — no GPU/HW, or root/operator-only) Confidence: certain (source-trace confirmed bug is real)
Mechanism
smu8_dpm_get_pp_table_entry_callback (:1350-1356): clock_info_index clamped to hardwareActivityPerformanceLevels-1 (=7) but indexes table->entries[] where table->count is VBIOS ucNumEntries (may be <8). index>=count → OOB heap read. Value programmed to SMU and returned via performance_level.
Source: sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:1350-1356
Why it cannot be reproduced on this guest
HW-gated. amdgpu powerplay requires AMD SMU8 hardware. No GPU in QEMU guest.
Phase 6: Escalation Assessment
This is a HW-gated GPU module (amdgpu powerplay SMU8) finding. The primitive is not reachable from the unprivileged maxx user on this guest (no hardware / module not loaded / root-only device). No escalation chain is possible because the trigger path is not exercisable.
For GPU findings: the module (radeon.ko/amdgpu.ko/i915.ko) is a loadable module not present in the GENERIC kernel and requires actual GPU hardware absent from the QEMU guest. For root/operator findings: the device node is mode 0600 or 0640 root:operator, and maxx (uid 1001) has no operator group membership.
Fix
Clamp clock_info_index to min(table->count-1, hwLevels-1). Check table!=NULL and table->count>0.
Fix description: Additionally clamp clock_info_index to table->count-1 after the hwLevels clamp.
The full git-apply-able diff is in fix.diff. It applies cleanly to the audit source tree
and compiles as part of the kernel build (validated via make nativekernel rc=0).
Classification
- status: inconclusive
- reproduced: 0
- impact: none
- fix_status: not_testable (HW-gated: PoC cannot run on guest; diff applies + compiles verified)
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- p
- o
- w
- e
- r
- p
- l
- a
- y
- /
- h
- w
- m
- g
- r
- /
- s
- m
- u
- 8
- _
- h
- w
- m
- g
- r
- .
- c
- :
- 1
- 3
- 5
- 0
- -
- 1
- 3
- 5
- 6
Detail
Exploit chain
none (OOB heap read — read-only primitive. HW-gated: amdgpu powerplay on Carrizo/Stoney. Not reachable from QEMU.)
Evidence (decisive lines)
Source trace: smu8_hwmgr.c:1352-1353 'if (clock_info_index > hwLevels-1) clock_info_index = hwLevels-1' — clamps to 7. :1356 'table->entries[clock_info_index]' — but table->count may be <8, no check.
PoC changes
Authored fix.diff: additionally clamp clock_info_index to table->count-1 after the hwLevels clamp.
Verified recommended fix
Clamp clock_info_index to min(table->count-1, hwLevels-1). matches finding proposal. Full diff in findings/poc/DF-1418/fix.diff.
Verdict
CONFIRMED BY SOURCE TRACE. smu8_dpm_get_pp_table_entry_callback (:1350-1356): clock_info_index clamped to hardwareActivityPerformanceLevels-1 (=7) but indexes table->entries[] where table->count is VBIOS ucNumEntries (may be <8). index>=count → OOB heap read. Value programmed to SMU. Bug is real but HW-gated: amdgpu powerplay requires SMU8.
No comments yet.