Signed integer overflow in amdsb_watchdog period conversion, enabled by 100x-wrong period_max
Summary
amdsbwd.c:217 timeout=(period*1000)/sc->ms_per_tick both operands int so multiplication performed in int overflows signed for period>2147483. Result assigned unsigned int timeout. C UB signed overflow. sc->wdog.period_max L518 (UINT16_MAX*1000)/10=6553500 seconds ~3x beyond overflow threshold ~100x larger than true hardware max (max_ticks*ms_per_tick)/1000=65535 seconds. Stray /10 divisor inflates period_max 100x exposes overflow. wdog framework does NOT enforce period_max (XXX comment kern_wdog.c:121). Root trigger sysctl kern.watchdog.period=3000000 -> 3000000*1000=3e9 overflows INT_MAX 2.147e9. Impact: watchdog programmed to unintended interval (clamped max_ticks=65535) hardware-bounded reliability violation not memory corruption/escalation. Driver creates NO /dev/amdsbwd only registers struct watchdog root-only /dev/wdog 0600. Fix: uint64_t cast in conversion; correct period_max=(max_ticks*ms_per_tick)/1000.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1890 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 695 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 710 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1890 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: amdsbwd.c:217 timeout=(period*1000)/sc->ms_per_tick both operands int so multiplication performed in int overflows signed for period>2147483. Result assigned unsigned int timeout. C UB signed overflow
Citation: sys/dev/misc/amdsbwd/amdsbwd.c:217-518
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: signed int overflow in (period*1000) watchdog period (amdsbwd.c:217,518)
Verified recommended fix
Source-confirmed: signed int overflow in (period*1000) watchdog period (amdsbwd.c:217,518)
Verdict
Source-confirmed: signed int overflow in (period*1000) watchdog period (amdsbwd.c:217,518)
No comments yet.