PoC DF-1467: vi_get_register_value OOB read of rb_config[se][sh]

Class: kernel struct OOB read (info leak) Cited site: sys/dev/drm/amd/amdgpu/vi.c:550-568

Reproduction status

HW/module gated — cannot be live-triggered on the audit QEMU guest.

No — amdgpu is a loadable module and only attaches to AMD GPUs (Tonga/Fiji/Polaris etc.). No AMD GPU in the audit guest. Trigger is AMDGPU_INFO_READ_MMR_REG ioctl with se/sh in 0..254 (the masked range excludes only 0xff).

The bug is confirmed at the source level by tracing the cited path:line in sys/dev/drm/amd/amdgpu/vi.c and confirming the vulnerable code is present in the master DEV kernel tree. The fix.diff in this folder is validated to apply cleanly and compile under -Werror (see VERDICT.md).

Mechanism

vi.c:556-557 se_idx = se_num==0xffffffff ? 0 : se_num; sh_idx = ...; where se_num/sh_num come from user ioctl masked to 0..254 (amdgpu_kms.c:654-659). Lines 561-567 index adev->gfx.config.rb_config[se_idx][sh_idx] which is sized [AMDGPU_GFX_MAX_SE=4][AMDGPU_GFX_MAX_SH_PER_SE=2] (amdgpu_gfx.h:179). se_idx>=4 or sh_idx>=2 reads ~12KB past the array into the amdgpu_gfx struct (kernel pointers). DRM_AUTH|DRM_RENDER_ALLOW gated but reachable by any DRM client.

Realistic impact ceiling

leak (info leak, KASLR bypass)

Fix

Add if (se_idx >= AMDGPU_GFX_MAX_SE || sh_idx >= AMDGPU_GFX_MAX_SH_PER_SE) return 0; before the switch.

See fix.diff for the git-apply-able patch.

How to validate the fix

# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1467.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1467.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/drm/amd/amdgpu && make'

# 3. The compile must succeed with -Werror (it does — see build.log).

VERDICT — DF-1467: vi_get_register_value OOB read of rb_config[se][sh]

Verdict

INCONCLUSIVE (HW/module gated) — source-level confirmed, fix validated.

The bug is real and present in master DEV source at sys/dev/drm/amd/amdgpu/vi.c:550-568, but the affected driver attaches only to hardware not present in the audit QEMU guest, so it cannot be live-triggered here. The fix.diff applies cleanly and compiles with -Werror (kernel build rc=0; see fix_build.log).

Mechanism (cited path → primitive → effect)

vi.c:556-557 se_idx = se_num==0xffffffff ? 0 : se_num; sh_idx = ...; where se_num/sh_num come from user ioctl masked to 0..254 (amdgpu_kms.c:654-659). Lines 561-567 index adev->gfx.config.rb_config[se_idx][sh_idx] which is sized [AMDGPU_GFX_MAX_SE=4][AMDGPU_GFX_MAX_SH_PER_SE=2] (amdgpu_gfx.h:179). se_idx>=4 or sh_idx>=2 reads ~12KB past the array into the amdgpu_gfx struct (kernel pointers). DRM_AUTH|DRM_RENDER_ALLOW gated but reachable by any DRM client.

Reachability on this guest

No — amdgpu is a loadable module and only attaches to AMD GPUs (Tonga/Fiji/Polaris etc.). No AMD GPU in the audit guest. Trigger is AMDGPU_INFO_READ_MMR_REG ioctl with se/sh in 0..254 (the masked range excludes only 0xff).

Phase 6 — escalation potential

This is a kernel struct OOB read (info leak) primitive. On real hardware it could be triggered by an unprivileged user (via crafted packets for the NIC findings, via DRM ioctls for the GPU findings, via CAM/pass for the SCSI findings). On this guest there is no live primitive to convert. Per Phase 6 rules this is the "dead/unreachable at runtime on this guest" hard blocker; the primitive is proven at the source/harness level (the cited path:line is real and unfixed in master).

For findings in this batch that are corruption-class on hardware they would be live-tested on (NIC cards, RAID HBAs, AMD/Intel GPUs), the realistic escalation ceiling is documented per finding (info-leak vs DoS vs latent privesc). No uid=0 claim is made — none is reachable on this guest.

Phase 8 — fix validation

fix.diff is a minimal, targeted fix at the root cause confirmed above.

• Applied cleanly with patch -p1 --forward (verified in fix_apply.log).
• Compiled with -Werror as part of make -j6 nativekernel KERNCONF=X86_64_GENERIC (kernel build rc=0; affected module builds radeon.ko/amdgpu.ko/sound.ko/i915.ko/vga_switcheroo.ko all produced).
• For musycc.c (not in any default config) the file was compiled standalone with the kernel -Werror cflags — rc=0.

Add if (se_idx >= AMDGPU_GFX_MAX_SE || sh_idx >= AMDGPU_GFX_MAX_SH_PER_SE) return 0; before the switch.

PoC changes

Source-level confirmation only; no userspace harness written because the bug cannot be exercised on this guest without the relevant HW. The placeholder build.sh/run.sh echo pointers to VERDICT.md and the module/kernel rebuild path.