Off-by-one in get_powerplay_table_entry_v1_0 allows OOB read of one state entry
Summary
process_pptables_v1_0.c:1310 PP_ASSERT_WITH_CODE(entry_index <= state_arrays->ucNumEntries) uses <= instead of <. entry_index==ucNumEntries passes -> entries[ucNumEntries] one past end -> 20 bytes OOB BIOS image read. Latent: sole caller pp_psm.c:75-89 iterates i<table_entries. Fix: change <= to <.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1577 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 700 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 737 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1577 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: process_pptables_v1_0.c:1310 PP_ASSERT_WITH_CODE(entry_index <= state_arrays->ucNumEntries) uses <= instead of <. entry_index==ucNumEntries passes -> entries[ucNumEntries] one past end -> 20 bytes OOB
Citation: sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:1310-1315
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: entry_index<=ucNumEntries off-by-one OOB read (process_pptables_v1_0.c:1310)
Verified recommended fix
Source-confirmed: entry_index<=ucNumEntries off-by-one OOB read (process_pptables_v1_0.c:1310)
Verdict
Source-confirmed: entry_index<=ucNumEntries off-by-one OOB read (process_pptables_v1_0.c:1310)
No comments yet.