DF-1264 PoC — drm_dp_sideband_msg_build chunk[48] OOB write

Status

INCONCLUSIVE on the audit guest: bug confirmed real by source trace at sys/dev/drm/drm_dp_mst_topology.c:326, but hardware-gated and not triggerable here. fix.diff authored and validated to apply + compile (nativekernel rc=0, -Werror). See VERDICT.md for the full trace and fix.diff for the patch.

Build

./build.sh

(equivalent: cc -O2 -Wall -o dp_sideband_oob dp_sideband_oob.c)

Run (as unprivileged user)

./run.sh

Expected on the audit guest

The PoC runs and reports that the kernel trigger surface is absent on this QEMU/KVM guest (no LSI MegaRAID controller / no AMD Tonga GPU / no DP MST hardware; mfi is in-kernel but /dev/mfi0 is never created; drm/amdgpu are loadable modules that are not loaded and would not attach). It exits 0 without exercising the sink. The bug is therefore a latent, hardware-dependent defect, not a false positive.

Files

• dp_sideband_oob.c — trigger / documentation PoC
• fix.diff — standalone git apply -p1 patch closing the cited path
• VERDICT.md — full source-level mechanism + reachability + fix analysis
• build.log / run.log — captured build/run output
• fix_build.log — nativekernel compile-validation excerpt (rc=0)
• env.txt — guest environment
• manifest.json — machine-readable artifact catalog

DF-1264 — drm_dp_sideband_msg_build chunk[48] OOB write

Verdict

INCONCLUSIVE (hardware-gated latent bug, not triggerable on this guest). The OOB write is confirmed real by source tracing; not reachable on the audit QEMU guest because the sink lives in the loadable drm.ko module and is driven only by DisplayPort MST sideband replies from real MST hardware (absent). fix.diff authored and validated to apply + compile (nativekernel rc=0, -Werror).

Mechanism (source trace)

drm_dp_sideband_msg_build (sys/dev/drm/drm_dp_mst_topology.c:326):

struct drm_dp_sideband_msg_rx { u8 chunk[48]; u8 msg[256]; ... };   /* helper.h:215-225 */

if (hdr) {
    ...
    msg->curchunk_len = recv_hdr.msg_len;          /* 6-bit field, 0..63  (:349) */
    msg->curchunk_hdrlen = hdrlen;
    /* NO bound vs sizeof(msg->chunk)=48 */
    msg->curchunk_idx = min(msg->curchunk_len, (u8)(replybuflen - hdrlen));
    memcpy(&msg->chunk[0], replybuf + hdrlen, msg->curchunk_idx);   /* can be >48 (:365) */
} else {
    memcpy(&msg->chunk[msg->curchunk_idx], replybuf, replybuflen);  /* OOB  (:367) */
    msg->curchunk_idx += replybuflen;
}

• msg->curchunk_len comes from recv_hdr.msg_len, a 6-bit value (0–63) parsed from the sideband header, with a CRC4 the attacker controls.
• The header branch can copy up to curchunk_len (63) bytes into chunk[0], already 15 bytes past chunk[48].
• The non-header branch memcpy's replybuflen bytes at chunk[curchunk_idx] with no check that curchunk_idx + replybuflen <= sizeof(chunk). Across chunks, curchunk_idx grows toward 61 and the write runs off the end of chunk[48] into msg[256] / the count fields / initial_hdr of the drm_dp_sideband_msg_rx struct (and, depending on the embedding struct, adjacent heap).
• Input is an attacker-controlled MST sideband message — i.e. a malicious DP MST branch device / dock / monitor (or a fuzz-injected AUX reply).

Reachability on the audit guest

• drm_dp_sideband_msg_build is module-only: it is in drm.ko (nm /boot/kernel/drm.ko ⇒ drm_dp_sideband_msg_build), NOT in the base kernel (nm /boot/kernel/kernel | grep drm_dp_sideband ⇒ 0 hits). drm.ko is not loaded on the guest.
• Even loaded, it is only reached via the MST topology worker processing sideband replies from a DP MST branch device. The guest's only GPU is a virtio-class vgapci0; there is no DP MST topology. Not triggerable here.

Exploit chain

None — not exercisable on this guest (module-only + no DP MST HW). The primitive is a bounded-but-over-48 OOB write of attacker-shaped bytes (replybuf) into the drm_dp_sideband_msg_rx struct; reachable only with a malicious/buggy MST device on real display hardware.

PoC changes

Authored dp_sideband_oob.c — a documentation stub that records the reachability finding (sink is module-only / HW-driven; no userspace program can reach it on this guest).

Fix validation

• fix.diff applies cleanly: git apply --check -p1 ⇒ OK (2 hunks).
• Compiles: applied to /usr/src, make nativekernel rebuilt drm.ko ⇒ NK_DONE rc=0, drm_dp_mst_topology.c built with -Werror (fix_build.log).
• Functional test: not_testable (no DP MST HW; module not loadable into a path that reaches the sink).

Recommended fix

• Reject curchunk_len > sizeof(msg->chunk) right after it is assigned (bound the header-branch copy too).
• In the non-header branch, reject curchunk_idx + replybuflen > curchunk_len before the memcpy. See fix.diff.