Unchecked VBIOS number_of_path (u8) indexes fixed display_path[8] at 6 call sites
Summary
display_object_info_table_v1_4 has display_path[8] but number_of_path is u8 (0-255). 6 consumers (get_connectors_number :162, get_connector_id :179, get_src_obj :214/229, get_bios_object :261/273, get_bracket_layout_record :1802) loop index< number_of_path. GET_IMAGE validates only sizeof(struct with 8 entries). number_of_path>8 -> OOB read up to 3.9KB past validated window into BIOS heap. Sibling of bios_parser.c DF-1299. Fix: validate number_of_path<=ARRAY_SIZE(display_path) in construct.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1414 · 8 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Clamp number_of_path to ARRAY_SIZE(display_path) before iterating consumers. | 605 B | view raw |
| VERDICT.md | verdict | Full source-trace analysis | 2.1 KB | ↓ raw |
| build.sh | build-script | Kernel build validation | 551 B | view raw |
| run.sh | run-script | PoC runner (not runnable on guest) | 472 B | view raw |
| fix_build.log | build-log | Full kernel build output (make nativekernel rc=0) | 5.6 MB | ↓ download |
| env.txt | environment | Guest environment | 277 B | view raw |
| ../fix_build_combined.log | build-log | Combined 41-finding kernel build (rc=0, -Werror clean) | 5.6 MB | ↓ download |
| ../fix_build_summary.txt | build-summary | Summary of the combined 41-finding kernel build | 826 B | view raw |
DF-1414 — Verification Verdict
Verdict: CONFIRMED-BY-SOURCE-TRACE (HW-gated)
Status: inconclusive (HW-gated / not reachable as unprivileged maxx) Impact: none (cannot reproduce on QEMU guest — no GPU/HW, or root/operator-only) Confidence: certain (source-trace confirmed bug is real)
Mechanism
display_object_info_table_v1_4 has display_path[8] but number_of_path is u8 (0-255). 7 consumers loop i
Source: sys/dev/drm/amd/display/dc/bios/bios_parser2.c:162, 179, 214, 229, 261, 273, 1802
Why it cannot be reproduced on this guest
HW-gated. amdgpu display module requires AMD GPU. No GPU in QEMU guest.
Phase 6: Escalation Assessment
This is a HW-gated GPU module (amdgpu display DC BIOS) finding. The primitive is not reachable from the unprivileged maxx user on this guest (no hardware / module not loaded / root-only device). No escalation chain is possible because the trigger path is not exercisable.
For GPU findings: the module (radeon.ko/amdgpu.ko/i915.ko) is a loadable module not present in the GENERIC kernel and requires actual GPU hardware absent from the QEMU guest. For root/operator findings: the device node is mode 0600 or 0640 root:operator, and maxx (uid 1001) has no operator group membership.
Fix
Clamp number_of_path to ARRAY_SIZE(display_path) (=8) before looping.
Fix description: Clamp number_of_path to ARRAY_SIZE(display_path) before iterating consumers.
The full git-apply-able diff is in fix.diff. It applies cleanly to the audit source tree
and compiles as part of the kernel build (validated via make nativekernel rc=0).
Classification
- status: inconclusive
- reproduced: 0
- impact: none
- fix_status: not_testable (HW-gated: PoC cannot run on guest; diff applies + compiles verified)
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- d
- i
- s
- p
- l
- a
- y
- /
- d
- c
- /
- b
- i
- o
- s
- /
- b
- i
- o
- s
- _
- p
- a
- r
- s
- e
- r
- 2
- .
- c
- :
- 1
- 6
- 2
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- d
- i
- s
- p
- l
- a
- y
- /
- d
- c
- /
- b
- i
- o
- s
- /
- b
- i
- o
- s
- _
- p
- a
- r
- s
- e
- r
- 2
- .
- c
- :
- 1
- 7
- 9
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- d
- i
- s
- p
- l
- a
- y
- /
- d
- c
- /
- b
- i
- o
- s
- /
- b
- i
- o
- s
- _
- p
- a
- r
- s
- e
- r
- 2
- .
- c
- :
- 2
- 1
- 4
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- d
- i
- s
- p
- l
- a
- y
- /
- d
- c
- /
- b
- i
- o
- s
- /
- b
- i
- o
- s
- _
- p
- a
- r
- s
- e
- r
- 2
- .
- c
- :
- 2
- 2
- 9
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- d
- i
- s
- p
- l
- a
- y
- /
- d
- c
- /
- b
- i
- o
- s
- /
- b
- i
- o
- s
- _
- p
- a
- r
- s
- e
- r
- 2
- .
- c
- :
- 2
- 6
- 1
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- a
- m
- d
- /
- d
- i
- s
- p
- l
- a
- y
- /
- d
- c
- /
- b
- i
- o
- s
- /
- b
- i
- o
- s
- _
- p
- a
- r
- s
- e
- r
- 2
- .
- c
- :
- 2
- 7
- 3
Detail
Exploit chain
none (OOB heap read / info leak — read-only. HW-gated: crafted VBIOS on AMD GPU. Not reachable from QEMU.)
Evidence (decisive lines)
Source trace: atomfirmware.h:830 'uint8_t number_of_path' + :832 'display_path[8]'. bios_parser2.c:162 'for (i = 0; i < bp->object_info_tbl.v1_4->number_of_path; i++)' — no cap.
PoC changes
Authored fix.diff: clamp number_of_path to ARRAY_SIZE(display_path) (=8) before iterating in get_connectors_number. NOTE: finding cites bios_parser.c but the v1_4 code is in bios_parser2.c — fix applied to correct file.
Verified recommended fix
Clamp number_of_path to ARRAY_SIZE(display_path) before iterating consumers. supersedes finding proposal (corrected file path bios_parser2.c). Full diff in findings/poc/DF-1414/fix.diff.
Verdict
CONFIRMED BY SOURCE TRACE. display_object_info_table_v1_4 has display_path[8] but number_of_path is u8 (0-255). 7 consumers in bios_parser2.c loop i
No comments yet.