Boot-time kernel pointer leak via dev_info %p of fence cpu_addr
Summary
radeon_fence.c:861-862 dev_info(rdev->dev, fence driver on ring %d use gpu addr 0x%016lx and cpu addr 0x%p, ring, gpu_addr, cpu_addr). cpu_addr is volatile uint32_t* kernel VA. kvprintf %p (subr_prf.c:736) only obfuscates when security.ptr_restrict!=0 (default 0). Full kernel pointer written to dmesg/dmesg.boot world-readable. One known-good kernel address for KASLR bypass. Emitted per ring per attach (boot/resume/reload). Fix: print mapped/unmapped boolean instead of %p.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1632 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 398 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/dev/drm/radeon/radeon_fence.c:861: boot-time kernel pointer leak via dev_info %p of fence cpu_addr
Verified recommended fix
Source-confirmed at sys/dev/drm/radeon/radeon_fence.c:861: boot-time kernel pointer leak via dev_info %p of fence cpu_addr
Verdict
Source-confirmed at sys/dev/drm/radeon/radeon_fence.c:861: boot-time kernel pointer leak via dev_info %p of fence cpu_addr
No comments yet.