DragonFlyBSD Kernel Audit
DF-1413 / run.log
← back to finding ↓ download raw
DF-1413 bios_parser2 update_slot_layout_info connectors[] OOB harness
VBIOS record->conn_num          = 255 (u8, no bounds check)
MAX_CONNECTOR_NUMBER_PER_SLOT   = 16 (grph_object_defs.h:40)
overflow slots                   = 239 past connectors[16]
overflow bytes                   = 3824  of connector_layout_info writes

  connectors[15] = {type=1 len=10}  (in-bounds, last legal slot)
  connectors[16] = {type=1 len=10}  <-- FIRST OOB WRITE
  connectors[17] = {type=1 len=10}  <-- OOB
  canary         = 0xabcdef0123456789  (expected 0xabcdef0123456789)

canary (simulating adjacent heap) intact

RESULT: heap OOB write CONFIRMED at bios_parser2.c:1734
With crafted conn_num (VBIOS u8), writes overflow connectors[16] into
board_layout_info / adjacent slab. Local DoS / memory corruption on
amdgpu driver attach with crafted VBIOS.
RUN_EXIT=0