clockmod: raw wrmsr(MSR_THERM_CONTROL) without a fault-safe accessor — a VMM advertising CPUID ACPI+TM but faulting the MSR turns the root sysctl select / kldunload raise-to-100% into an unrecoverable #GP panic (DF-4735 family)
Summary
Bare wrmsr per target CPU; the attach gate matches the SDM so real silicon is safe, but a CPUID-lying VMM converts the root sysctl write and the unload-time raise into #GP. Guest-negative-verified (this CPU lacks both bits - clockmod never attaches). wrmsr_safe + error-propagation fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4825 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 980 B | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
CPUID-lying VMM -> root sysctl machdep.clockmod_domN.select=50.00% (or kldunload) -> wrmsr #GP -> panic
Evidence (decisive lines)
findings/poc/DF-4825/ (this verdict)
Verdict
Hardening (DF-4735 family): clockmod_select_handler issues a bare wrmsr(MSR_THERM_CONTROL) per target CPU - any VMM advertising CPUID ACPI+TM but faulting the MSR turns the root sysctl select write and the kldunload raise-to-100% into a kernel #GP panic. Safe on real silicon (gate matches SDM). Guest-negative-verified: this QEMU CPU lacks both bits so clockmod never attaches (no machdep.clockmod_dom0 oid, kldload inert) - unreachable here. rdmsr_safe/wrmsr_safe-with-error-propagation fix.
No comments yet.