⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1961

Heap OOB write in k8pnow_decode_pst insertion sort from unchecked pst->n_states>16

Summary

state_table[POWERNOW_MAX_STATES=16] powernow.c:99. k8pnow_states L190 cstate->n_states=pst->n_states uint8 0..255 no upper-bound check. k8pnow_decode_pst L143 loop n_states iterations insertion-sort L152-160 memcpy(&state_table[j]) j up to n_states-1. n_states>16: indices 16..254 OOB write ~1.9KB past state_table into trailing struct fields then adjacent M_DEVBUF heap. Written content BIOS-controlled (fid/vid/freq) 8-byte tuples. Trigger: BIOS/VM firmware emits matching PST n_states>16. Impact: kernel heap corruption ring-0 code exec during subsequent setperf/curfreq traversals. Fix: reject pst->n_states==0||>POWERNOW_MAX_STATES return 0.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1961 · 4 files
FileTypeDescriptionSize
VERDICT.md verdict verification narrative 1.6 KB ↓ raw
fix.diff suggested-fix git-apply-able fix 718 B view raw
manifest.json misc manifest.json 1.2 KB view raw
fix_build_summary.txt build-log combined 16-finding kernel build rc=0 826 B view raw
VERDICT.md verdict verification narrative
↓ download raw

DF-1961 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/powermng/powernow/powernow.c:99-193. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

powernow (loaded as module, AMD K7/K8 only). Source: state_table[POWERNOW_MAX_STATES=16] at L99. k8pnow_states at L190 sets cstate->n_states=pst->n_states (uint8 0..255) with no upper-bound check. k8pnow_decode_pst at L143 loops n_states iterations; insertion-sort at L152-160 memcpy(&state_table[j]) with j up to n_states-1 — if pst->n_states>16, OOB write past state_table.

Check if (cstate->n_states > POWERNOW_MAX_STATES) return 0; at the top of k8pnow_decode_pst.

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none (HW/module gated: OOB write primitive exists in source but requires real AMD CPU with crafted BIOS PST tables)

Evidence (decisive lines)

Combined kernel build: 16 fix.diffs applied, make -j6 nativekernel => rc=0, 0 warnings, 0 errors.

PoC changes

VERDICT.md/fix.diff/manifest.json pre-existed; validated in this combined build.

Verified recommended fix

Add if (cstate->n_states > POWERNOW_MAX_STATES) return 0; at the top of k8pnow_decode_pst. Matches finding proposal.

Verdict

SOURCE-CONFIRMED (HW/module gated). state_table[POWERNOW_MAX_STATES=16] at powernow.c:99. k8pnow_states (L190) sets cstate->n_states=pst->n_states (uint8 0..255) with no upper-bound check. k8pnow_decode_pst (L143) loops n_states iterations; insertion-sort at L152-160 memcpy(&state_table[j]) with j up to n_states-1. If pst->n_states>16: OOB write ~1.9KB past state_table into adjacent heap. Confirmed by source trace. Not runnable: powernow module, AMD K7/K8 only.