DragonFlyBSD Kernel Audit
DF-1199 / run.log
← back to finding ↓ download raw
== DF-1199 radeon_atombios_get_asic_ss_info underflow harness ==
sizeof(ATOM_COMMON_TABLE_HEADER)=4 sizeof(V2)=12

size=    0 -> num_indices=1431655765   <-- UNDERFLOW (huge loop -> OOB read)
size=    1 -> num_indices=1431655765   <-- UNDERFLOW (huge loop -> OOB read)
size=    2 -> num_indices=1431655765   <-- UNDERFLOW (huge loop -> OOB read)
size=    3 -> num_indices=1431655765   <-- UNDERFLOW (huge loop -> OOB read)
size=    4 -> num_indices=0
size=   16 -> num_indices=1
size=   40 -> num_indices=3

Finding's cited value: size=2 -> num_indices=1431655765 (== 1431655765 ? YES)
size_t trace: (2 - 4) = 0xfffffffffffffffe (18446744073709551614);  /12 = 0x1555555555555555; trunc->int = 1431655765

[BUG REPRODUCED] malicious VBIOS with size<4 drives a 1431655765-iteration loop reading 12B/iter past the BIOS table.
Fixed kernel checks `size >= sizeof(ATOM_COMMON_TABLE_HEADER)` before the subtraction and bails.
RUN_EXIT=0