Heap OOB read in radeon_print_display_setup via BIOS-controlled encoder_id indexing encoder_names[38]
Summary
radeon_print_display_setup at radeon_display.c:813-833: encoder_names[encoder_id] where array has 38 entries. encoder_id from BIOS OBJECT_ID_MASK=0xFF range 0-255. Valid ATOM IDs 0x26(38)/0x27(39)/0xFF(255) all exceed array. OOB read of .rodata -> garbage char* -> DRM_INFO %s -> console info leak or panic. Crafted/corrupt VBIOS or hostile PCIe DVO. Fix: bounds-check encoder_id<ARRAY_SIZE(encoder_names).
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1432 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 954 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 3.1 KB | view raw |
DF-1432 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
Heap OOB read in radeon_print_display_setup via BIOS-controlled encoder_id indexing encoder_names[38]
Source Location
sys/dev/drm/radeon/radeon_display.c:714-833
Verdict
Source-confirmed: Heap OOB read in radeon_print_display_setup via BIOS-controlled encode. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
radeon_print_display_setup at radeon_display.c:813-833: encoder_names[encoder_id] where array has 38 entries. encoder_id from BIOS OBJECT_ID_MASK=0xFF range 0-255. Valid ATOM IDs 0x26(38)/0x27(39)/0xFF(255) all exceed array. OOB read of .rodata -> garbage char* -> DRM_INFO %s -> console info leak or panic. Crafted/corrupt VBIOS or hostile PCIe DVO. Fix: bounds-check encoder_id<ARRAY_SIZE(encoder_names).
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: radeon_print_display_setup uses BIOS-controlled encoder_id as index into encoder_names[38] without bound, OOB read. Added nitems() bound. HW-gated.
Verified recommended fix
Source-confirmed: radeon_print_display_setup uses BIOS-controlled encoder_id as index into encoder_names[38] without bound, OOB read. Added nitems() bound. HW-gated.
Verdict
Source-confirmed: radeon_print_display_setup uses BIOS-controlled encoder_id as index into encoder_names[38] without bound, OOB read. Added nitems() bound. HW-gated.
No comments yet.