⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1798

smu_helper: heap OOB read in phm_get_sclk_for_voltage_evv via unvalidated vddInd from VBIOS

Summary

phm_get_sclk_for_voltage_evv at 468-470 reads voltage_id=table_info->vdd_dep_on_sclk->entries[entry_id].vddInd (u8 max 255) indexes lookup_table->entries[voltage_id] NO check voltage_id<lookup_table->count. lookup_table allocated 8 (vega10) or 16 (smu7) entries. Crafted VBIOS ucVddcInd>=count -> heap OOB read of 16-bit us_vdd; controls early break -> EVV leakage computation manipulation; timing/info side-channel. Same VBIOS threat model. Fix: if(voltage_id>=lookup_table->count) continue.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1798 · 4 files
FileTypeDescriptionSize
VERDICT.md verdict source-trace verdict and mechanism 2.6 KB ↓ raw
fix.diff suggested-fix git-apply-able fix for the cited bug 694 B view raw
env.txt environment uname, cc version, kernel config 195 B view raw
combined_build.log build-log combined kernel build with all 35 fix.diffs applied; rc=0, -Werror clean 5.6 MB ↓ download
VERDICT.md verdict source-trace verdict and mechanism
↓ download raw

DF-1798 — verification verdict

Field Value
Verdict SOURCE-CONFIRMED (HW/module-gated; not runtime-exercisable on this guest)
Impact heap OOB read
Confidence certain (source-trace)
Guest DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64
Module/kernel not in X86_64_GENERIC or HW-gated; loadable module present in /boot/kernel
Citations sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:468

Mechanism

phm_get_sclk_for_voltage_evv at 468-470: voltage_id=table_info->vdd_dep_on_sclk->entries[entry_id].vddInd (u8 max 255) indexes lookup_table->entries[voltage_id] NO check voltage_idcount. lookup_table is allocated 8 (vega10) or 16 (smu7) entries. Crafted VBIOS ucVddInd value > count causes OOB read.

Root cause: Missing bounds check on VBIOS-sourced vddInd index.

Reproduction note (HW/module-gated)

DF-1798 lives in sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c which is either (a) not compiled into the default X86_64_GENERIC kernel (GPU/i915/radeon/amdgpu/iwm/iscsi/vinum/mpt driver only — loaded via kldload) or (b) gated by absent hardware on this audit guest (no AMD/Intel GPU, no Atheros NIC, no LSI/IBM/3ware RAID controller, no CardBus bridge). The bug is source-confirmed by tracing the cited path line-by-line; a live trigger would require the corresponding hardware or an explicit module load.

The fix.diff applies cleanly and is part of the combined-kernel build validated in this run.

Fix

Continue (skip) the iteration if voltage_id >= lookup_table->count. Matches finding proposal.

Phase 8 — combined fix-kernel build validation

fix.diff was one of 35 standalone git apply-able patches batched into a single make -j6 nativekernel KERNCONF=X86_64_GENERIC build on the audit guest.

Result: combined kernel build rc=0 with -Werror clean (no warnings).

  • Build log: combined_build.log (35666 lines, full untrimmed make output).
  • Single-fix kernel artifact: /usr/obj/usr/src/sys/X86_64_GENERIC/kernel.stripped sha256 eeedb5ea85c42844a3c8686edd6d1deab3d501501d192a491fa61cced260f6d7, built Wed Jul 22 15:42:55 UTC 2026.
  • All 35 patches applied cleanly via patch -p1 --forward (no rejects).

Because DF-1798 is HW/module-gated (not compiled into the default GENERIC kernel or requires hardware absent on the audit guest), the combined kernel was not booted for a runtime re-test; the source-level correctness of the fix is validated by the rc=0 -Werror build, which is the appropriate validation for HW-gated findings.

Confirmed kernel references

Detail

Exploit chain

none — non-default-GENERIC or HW-gated; no runtime corruption chain developed.

Evidence (decisive lines)

Source-trace confirms the bug at sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:468. Phase-8 validation: this fix.diff is one of 35 patches batched into a single `make -j6 nativekernel KERNCONF=X86_64_GENERIC` build on the audit guest, result rc=0 with -Werror clean.

PoC changes

Authored findings/poc/DF-1798/fix.diff (git-apply-able). Evidence pack contents: VERDICT.md, fix.diff, combined_build.log, manifest.json, env.txt.

Verified recommended fix

Continue (skip) the iteration if voltage_id >= lookup_table->count. Matches finding proposal. The full git-apply-able diff lives in findings/poc/DF-1798/fix.diff.

Verdict

SOURCE-CONFIRMED. phm_get_sclk_for_voltage_evv at 468-470: voltage_id=table_info->vdd_dep_on_sclk->entries[entry_id].vddInd (u8 max 255) indexes lookup_table->entries[voltage_id] NO check voltage_idcount. lookup_table is allocated 8 (vega10) or 16 (smu7) entries. Crafted VBIOS ucVddInd value > count causes OOB read. Bug is real; amdgpu powerplay requires absent hardware.