Heap OOB read in hdaa_eld_dump: computed length never bounds field/SAD access
Summary
hdaa_eld_dump at hdaa.c:636-714: only bounds guard is w->eld_len<4 at :644. len=min(eld_len, eld[2]*4) computed at :651 but NEVER used to bound subsequent accesses. Malicious HDMI/DP codec reports eld_len=4 but sets MNL(eld[4]&0x1f)=31 and SAD_Count(eld[5]>>4)=15 -> unconditional reads eld[4]..eld[19] (already past 4-byte allocation), monitor name at eld[20] for 31 chars, SAD loop up to eld[20+31+14*3+2]=eld[95] -> 91 bytes past 4-byte heap allocation. Gated behind HDA_BOOTVERBOSE (boot -v or hw.snd.verbose>3). Attacker: malicious HDA codec (QEMU VM host or compromised firmware). Impact: kernel panic (guard page) or heap info leak to console/msgbuf (world-readable). Fix: bound all accesses by len.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1135 · 3 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | Source-confirmation verdict for DF-1135 | 617 B | ↓ raw |
| fix.diff | suggested-fix | Bound eld accesses with minimum length check | 369 B | view raw |
| ../fix_build.log | build-log | Batch kernel build log (all fixes, rc=0) | 5.6 MB | ↓ download |
DF-1135 Verification Verdict
Severity: Low Impact class: oob_read Verification method: Source-only confirmation (HW-gated, not triggerable on QEMU guest)
Verdict: REPRODUCED (source-confirmed)
The bug is confirmed in the audited source at the cited path:line. Triggerable but requires specific driver/config.
Fix: Bound eld accesses with minimum length check
Fix applied and validated in batch kernel build (rc=0, -Werror).
Fix validation
All 41-fix patches batched into single make -j6 nativekernel KERNCONF=X86_64_GENERIC build.
Build result: rc=0, 0 errors (full -Werror clean).
Fix verification
fixedVALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
VALIDATED: fix.diff applies cleanly + batch kernel build rc=0 -Werror; bug HW/module/runtime-gated, no runtime PoC re-test possible on guest.
Confirmed kernel references
—
Detail
Exploit chain
none
Evidence (decisive lines)
REPRODUCED (source-only): hdaa_eld_dump bounds check (w->eld_len<4) is insufficient; computed len = min(eld_len, eld[2]*4) is never used to bound subsequent accesses. Malicious codec ELD -> OOB read.
Verified recommended fix
REPRODUCED (source-only): hdaa_eld_dump bounds check (w->eld_len<4) is insufficient; computed len = min(eld_len, eld[2]*4) is never used to bound subsequent accesses. Malicious codec ELD -> OOB read.
Verdict
REPRODUCED (source-only): hdaa_eld_dump bounds check (w->eld_len<4) is insufficient; computed len = min(eld_len, eld[2]*4) is never used to bound subsequent accesses. Malicious codec ELD -> OOB read.
No comments yet.