Unbounded VBIOS LVDS record-parsing loop enables OOB read of kernel heap
Summary
amdgpu_atombios_encoder_get_lcd_info at atombios_encoders.c:2156: while(*record!=ATOM_RECORD_END_TYPE) advances record through VBIOS data without bounds check vs bios_size (256KB). Record ptr from usModePatchTableOffset. Advances by fixed sizes or fake_edid_length+2 (up to 257B). Past bios_end -> OOB read. fake_edid memcpy copies up to 255B OOB into EDID buffer -> potentially exposed to unprivileged users via connector EDID ioctl. Crafted VBIOS (root flash or malicious PCIe). Sibling of radeon/atombios_encoders.c identical pattern. Fix: bound record < bios_end in while and before memcpy.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1380 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1018 B | ↓ raw |
DF-1380 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: speculative
Finding
Unbounded VBIOS LVDS record-parsing loop enables OOB read of kernel heap
Source Location
sys/dev/drm/amd/amdgpu/atombios_encoders.c:2156-2202
Verdict
Source-confirmed (complex fix): Unbounded VBIOS LVDS record-parsing loop enables OOB read of kernel he. No diff in batch.
Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build
Summary
amdgpu_atombios_encoder_get_lcd_info at atombios_encoders.c:2156: while(*record!=ATOM_RECORD_END_TYPE) advances record through VBIOS data without bounds check vs bios_size (256KB). Record ptr from usModePatchTableOffset. Advances by fixed sizes or fake_edid_length+2 (up to 257B). Past bios_end -> OOB read. fake_edid memcpy copies up to 255B OOB into EDID buffer -> potentially exposed to unprivileged users via connector EDID ioctl. Crafted VBIOS (root flash or malicious PCIe). Sibling of radeon/a
Fix verification
not_testablesource defect confirmed; complex fix not included in batch build
source defect confirmed; complex fix not included in batch build
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: atombios_encoders VBIOS LVDS record-parsing while loop has no bounds on record pointer, unbounded OOB heap read. Complex fix (atom_context has no length member). HW-gated.
Verified recommended fix
Source-confirmed: atombios_encoders VBIOS LVDS record-parsing while loop has no bounds on record pointer, unbounded OOB heap read. Complex fix (atom_context has no length member). HW-gated.
Verdict
Source-confirmed: atombios_encoders VBIOS LVDS record-parsing while loop has no bounds on record pointer, unbounded OOB heap read. Complex fix (atom_context has no length member). HW-gated.
No comments yet.