Sideband reply parsers memcpy attacker-controlled num_bytes without bounds check (OOB read past msg_rx)
Summary
drm_dp_sideband_parse_remote_dpcd_read (:433-451) and parse_remote_i2c_read_ack (:467-484): num_bytes=raw->msg[idx] (attacker u8 0-255), then if(idx>curlen)goto fail (checks idx only, NOT idx+num_bytes). memcpy(dest,&raw->msg[idx],num_bytes) reads msg[idx..idx+254]. With idx=3 num_bytes=255: reads msg[256]/[257] = curchunk_len/curchunk_idx fields. i2c path delivers to userspace via drm_dp_mst_i2c_xfer (:3334). /* TODO check */ comment at :478 acknowledges gap. Fix: check num_bytes<=curlen-idx before memcpy.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1265 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1.0 KB | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 484 B | view raw |
DF-1265 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: certain
Finding
Sideband reply parsers memcpy attacker-controlled num_bytes without bounds check (OOB read past msg_rx)
Source Location
sys/dev/drm/drm_dp_mst_topology.c:441-479
Verdict
Source-confirmed: Sideband reply parsers memcpy attacker-controlled num_bytes without bo. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
drm_dp_sideband_parse_remote_dpcd_read (:433-451) and parse_remote_i2c_read_ack (:467-484): num_bytes=raw->msg[idx] (attacker u8 0-255), then if(idx>curlen)goto fail (checks idx only, NOT idx+num_bytes). memcpy(dest,&raw->msg[idx],num_bytes) reads msg[idx..idx+254]. With idx=3 num_bytes=255: reads msg[256]/[257] = curchunk_len/curchunk_idx fields. i2c path delivers to userspace via drm_dp_mst_i2c_xfer (:3334). / TODO check / comment at :478 acknowledges gap. Fix: check num_bytes<=curlen-idx be
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: drm_dp_mst sideband reply parser memcpy uses attacker-controlled num_bytes without bound, OOB read past msg_rx. Added sizeof(bytes) bound.
Verified recommended fix
Source-confirmed: drm_dp_mst sideband reply parser memcpy uses attacker-controlled num_bytes without bound, OOB read past msg_rx. Added sizeof(bytes) bound.
Verdict
Source-confirmed: drm_dp_mst sideband reply parser memcpy uses attacker-controlled num_bytes without bound, OOB read past msg_rx. Added sizeof(bytes) bound.
No comments yet.