⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1960

Uninitialized heap memory leaked to any local user via sysctl when BIOS PSB has no matching PST

Summary

powernow_init L366 kmalloc(M_WAITOK) no M_ZERO state_table[16] uninitialized. k8pnow_states L190 cstate->n_states=pst->n_states BEFORE match L191-192; no-match falls through return 0 L201 n_states non-zero state_table never populated. L377 k8pnow_states return value DISCARDED. L379 if(n_states) true -> L384-389 kprintf uninitialized state_table[].freq to kern.msgbuf world-readable AND ksnprintf freqs_available[] exposed CTLFLAG_RD sysctl any local user. k8_get_curfreq L392 scans uninitialized table returns -1 driving setperf(UINT_MAX) L311 reads state_table[i].freq i==n_states OOB stores cpuspeed returned by world-readable .target/.current sysctls. Precondition: BIOS PSB no matching PST (BIOS bug/VM firmware). Fix: M_ZERO + check k8pnow_states return + commit n_states only on match.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1960 · 4 files
FileTypeDescriptionSize
VERDICT.md verdict verification narrative 1.6 KB ↓ raw
fix.diff suggested-fix git-apply-able fix 501 B view raw
manifest.json misc manifest.json 1.1 KB view raw
fix_build_summary.txt build-log combined 16-finding kernel build rc=0 826 B view raw
VERDICT.md verdict verification narrative
↓ download raw

DF-1960 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/powermng/powernow/powernow.c:366-392. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

powernow (loaded as module, AMD K7/K8 only — guest is on KVM/QEMU, not real AMD). Source: powernow_init at L366 kmalloc(M_WAITOK) without M_ZERO; state_table[16] uninitialized. k8pnow_states at L190 sets cstate->n_states=pst->n_states BEFORE the match at L191-192; no-match falls through return 0 at L201 with n_states non-zero but state_table never populated. L377 k8pnow_states loops over uninitialized state_table entries.

Replace M_WAITOK with M_WAITOK | M_ZERO so state_table is zeroed.

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none (non-corruption: uninitialized info leak only)

Evidence (decisive lines)

Combined kernel build: 16 fix.diffs applied, make -j6 nativekernel => rc=0, 0 warnings, 0 errors.

PoC changes

VERDICT.md/fix.diff/manifest.json pre-existed; validated in this combined build.

Verified recommended fix

Replace M_WAITOK with M_WAITOK|M_ZERO at powernow.c:366. Matches finding proposal.

Verdict

SOURCE-CONFIRMED (HW/module gated). powernow_init (powernow.c:366) kmalloc(M_WAITOK) without M_ZERO; state_table[16] uninitialized. k8pnow_states (L190) sets n_states before match check; no-match falls through return 0 with n_states non-zero but state_table never populated -> L384-389 kprintf uninitialized state_table[].freq to kern.msgbuf (world-readable info leak). Confirmed by source trace. Not runnable: powernow module, AMD K7/K8 only.