DF-4905 — k8pnow_states() PST walk reads past the BIOS window with no bound

File: sys/dev/powermng/powernow/powernow.c:174-198 Severity: Low · Bucket: base:dev · Confidence: speculative (code certain; impact gated on BIOS/VM-firmware control)

Root cause

The PSB scan walks the 0xe0000-0x100000 window in 16-byte steps (powernow.c:174-176). Once an "AMDK7PNOW!" signature is found, the inner PST loop iterates psb->n_pst times (u8, up to 255) and advances

p += sizeof(struct pst_s) + 2 * cstate->n_states;   /* powernow.c:196-197 */

without any bounds check against BIOS_START+BIOS_LEN. Each step is 8 + 2*n_states ≤ 518 bytes; a corrupt or hostile PSB header (flash corruption, VM firmware image, or a re-flashed BIOS) walks p up to ~132 KB past 0x100000. BIOS_PADDRTOVADDR(x) = (x) + KERNBASE (sys/platform/pc64/include/pc/bios.h:36), so the reads land in the kernel's own physical load region (text/data) — mapped, so they do not fault; they silently parse kernel memory as PST headers (pst->cpuid/fid/vid comparisons at powernow.c:191-192).

Consequences:

• If the stray bytes happen to match cpuid == cpusig && fid == maxfid && vid == maxvid, k8pnow_decode_pst() is invoked on an arbitrary in-kernel pointer (powernow.c:193-194) — its n_states is then bounded only by DF-1961's missing check (heap OOB write up to 255 entries).
• Otherwise the reads stay internal (values are compared, not copied out) — no direct disclosure; this is an OOB-read robustness defect in the same BIOS-trust threat model as the known DF-1960/DF-1961 family.

The signature scan also has no early sanity check on psb->n_pst and no PSB checksum validation (the PSB format defines none, but the walk bound is still mandatory).

Verification status

untested — reproducing requires controlling BIOS contents under an AMD K8 CPU; the audit guest is Intel/QEMU and the module's CPUID gate refuses (env.txt: MOD_LOAD error 2).

Recommended fix

Clamp the walk to the BIOS window before every pst dereference and before invoking the decoder — see fix.diff.

DF-4905 — VERDICT

status: untested · reproduced: 0 · impact: none (OOB read gated on firmware control) · confidence: speculative (code certain)

Narrative

k8pnow_states() (powernow.c:167-202) trusts two BIOS-provided counters after finding the "AMDK7PNOW!" signature: psb->n_pst (u8) and, per iteration, pst->n_states (u8). The advance p += sizeof(struct pst_s) + 2 * cstate->n_states (powernow.c:196-197) is performed n_pst times with no check that p stays below BIOS_PADDRTOVADDR(BIOS_START + BIOS_LEN). Maximum overshoot: 255 * (8 + 510) ≈ 132 KB past physical 0x100000, which via BIOS_PADDRTOVADDR(x) = (x) + KERNBASE (bios.h:36) is the kernel's own text/data — reads succeed silently. On a fortuitous match of cpuid/fid/vid (powernow.c:191-192), k8pnow_decode_pst() receives an interior kernel pointer and an attacker-influenced n_states whose only bound is the already-known DF-1961 defect (heap OOB write).

Threat model equals the known DF-1960/DF-1961 family: requires a corrupted or attacker-reflashed BIOS (or hostile VM firmware presenting K8 CPUID) — not reachable from the OS itself. Hence Low/speculative.

Verification

Not runtime-testable: the audit guest is Intel/QEMU; kldload powernow prints MOD_LOAD error 2 (CPUID gate, powernow.c:361-363) and the scan never executes (env.txt). No harness can exercise BIOS memory content from the OS side; analysis pack only.

Fix

fix.diff: two window checks — before dereferencing pst and before calling the decoder — bail out (return 0) when the header or the 2*n_states state array would cross the window end. Applies cleanly.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.