Divide-by-zero in sumo_calculate_bsp via BIOS-controlled high_clk=0
Summary
sumo_calculate_bsp at sumo_dpm.c:323: pasi=65535*100/high_clk. high_clk from ps->levels[num_levels-1].sclk or boost_pl.sclk, both VBIOS-derived. sclk=0 -> div-by-zero #DE panic on DPM state transition. Sibling of DF-1334 family. Crafted VBIOS. Fix: check high_clk!=0.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1438 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Add `if (high_clk == 0) return;` guard before division. | 364 B | view raw |
| VERDICT.md | verdict | Full source-trace analysis | 1.8 KB | ↓ raw |
| build.sh | build-script | Kernel build validation | 534 B | view raw |
| run.sh | run-script | PoC runner (not runnable on guest) | 454 B | view raw |
| fix_build.log | build-log | Full kernel build output (make nativekernel rc=0) | 5.6 MB | ↓ download |
| env.txt | environment | Guest environment | 277 B | view raw |
| ../fix_build_combined.log | build-log | Combined 41-finding kernel build (rc=0, -Werror clean) | 5.6 MB | ↓ download |
| ../fix_build_summary.txt | build-summary | Summary of the combined 41-finding kernel build | 826 B | view raw |
DF-1438 — Verification Verdict
Verdict: CONFIRMED-BY-SOURCE-TRACE (HW-gated)
Status: inconclusive (HW-gated / not reachable as unprivileged maxx) Impact: none (cannot reproduce on QEMU guest — no GPU/HW, or root/operator-only) Confidence: certain (source-trace confirmed bug is real)
Mechanism
sumo_calculate_bsp (:323): pasi=65535*100/high_clk. high_clk from ps->levels[num_levels-1].sclk or boost_pl.sclk, both VBIOS-derived. sclk=0 → div-by-zero #DE panic on DPM state transition.
Source: sys/dev/drm/radeon/sumo_dpm.c:323
Why it cannot be reproduced on this guest
HW-gated. radeon.ko requires Sumo/Trinity ASIC. No GPU in QEMU guest.
Phase 6: Escalation Assessment
This is a HW-gated GPU module (radeon DPM Sumo) finding. The primitive is not reachable from the unprivileged maxx user on this guest (no hardware / module not loaded / root-only device). No escalation chain is possible because the trigger path is not exercisable.
For GPU findings: the module (radeon.ko/amdgpu.ko/i915.ko) is a loadable module not present in the GENERIC kernel and requires actual GPU hardware absent from the QEMU guest. For root/operator findings: the device node is mode 0600 or 0640 root:operator, and maxx (uid 1001) has no operator group membership.
Fix
Check high_clk != 0 before division; return early if 0.
Fix description: Add if (high_clk == 0) return; guard before division.
The full git-apply-able diff is in fix.diff. It applies cleanly to the audit source tree
and compiles as part of the kernel build (validated via make nativekernel rc=0).
Classification
- status: inconclusive
- reproduced: 0
- impact: none
- fix_status: not_testable (HW-gated: PoC cannot run on guest; diff applies + compiles verified)
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- r
- a
- d
- e
- o
- n
- /
- s
- u
- m
- o
- _
- d
- p
- m
- .
- c
- :
- 3
- 2
- 3
Detail
Exploit chain
none (div-by-zero DoS — no write primitive. HW-gated: radeon DPM on Sumo/Trinity. Not reachable from QEMU.)
Evidence (decisive lines)
Source trace: sumo_dpm.c:323 'pi->pasi = 65535 * 100 / high_clk' — no zero check. high_clk derived from VBIOS sclk values.
PoC changes
Authored fix.diff: add 'if (high_clk == 0) return;' guard before division.
Verified recommended fix
Check high_clk != 0 before division; return early if 0. matches finding proposal. Full diff in findings/poc/DF-1438/fix.diff.
Verdict
CONFIRMED BY SOURCE TRACE. sumo_calculate_bsp at sumo_dpm.c:323: pasi=65535*100/high_clk. high_clk from ps->levels[num_levels-1].sclk or boost_pl.sclk (both VBIOS-derived). sclk=0 → div-by-zero #DE panic on DPM state transition. Bug is real but HW-gated: radeon.ko requires Sumo/Trinity ASIC.
No comments yet.