Undersized freqs_available[80] overflows when formatting 16-state list (80 chars + NUL = 81)
Summary
powernow.c L343 static char freqs_available[80]. L380 freq_len=n_states*(sizeof(9999 )-1)+1 = n_states*5+1 = 81 for max 16 states. L386 ksnprintf(freqs_available+len,freq_len-len,...) uses freq_len NOT sizeof(freqs_available) as bound. 16 states 4-digit MHz: NNNN *15 + NNNN + NUL = 80+NUL=81 bytes into 80-byte buffer 1-byte BSS overrun. 5-digit MHz grows to 16 extra bytes. Init-time only BIOS-driven. Fix: enlarge to MAX_STATES*sizeof(99999 )+1 and bound ksnprintf by sizeof.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1962 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 357 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 716 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1962 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: powernow.c L343 static char freqs_available[80]. L380 freq_len=n_states(sizeof(9999 )-1)+1 = n_states5+1 = 81 for max 16 states. L386 ksnprintf(freqs_available+len,freq_len-len,...) uses freq_len NO
Citation: sys/dev/powermng/powernow/powernow.c:343-386
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: freqs_available[80] overflows for 16-state frequency list (powernow.c:343,386)
Verified recommended fix
Source-confirmed: freqs_available[80] overflows for 16-state frequency list (powernow.c:343,386)
Verdict
Source-confirmed: freqs_available[80] overflows for 16-state frequency list (powernow.c:343,386)
No comments yet.