SDMA firmware ucode payload length/offset not validated against firmware blob size - heap OOB read
Summary
sdma_v4_0_load_microcode at sdma_v4_0.c:920-929: fw_size=ucode_size_bytes/4, fw_data=fw->data+ucode_array_offset_bytes. Neither validated vs fw->datasize. amdgpu_ucode_validate only checks datasize==size_bytes. Crafted fw with size_bytes==filesize but ucode_size_bytes=0xFFFFFFFF -> ~4GB OOB read from fw kmalloc into GPU register. Root-controlled firmware file. Sibling of DF-1256/1316 family. Fix: validate offset+size<=datasize in load_microcode and amdgpu_ucode_validate.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1451 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1020 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 599 B | view raw |
DF-1451 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: certain
Finding
SDMA firmware ucode payload length/offset not validated against firmware blob size - heap OOB read
Source Location
sys/dev/drm/amd/amdgpu/sdma_v4_0.c:918-929
Verdict
Source-confirmed: SDMA firmware ucode payload length/offset not validated against firmwa. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
sdma_v4_0_load_microcode at sdma_v4_0.c:920-929: fw_size=ucode_size_bytes/4, fw_data=fw->data+ucode_array_offset_bytes. Neither validated vs fw->datasize. amdgpu_ucode_validate only checks datasize==size_bytes. Crafted fw with size_bytes==filesize but ucode_size_bytes=0xFFFFFFFF -> ~4GB OOB read from fw kmalloc into GPU register. Root-controlled firmware file. Sibling of DF-1256/1316 family. Fix: validate offset+size<=datasize in load_microcode and amdgpu_ucode_validate.
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: sdma_v4_0 firmware ucode payload length/offset from header not validated against firmware blob size, heap OOB read in fw loading loop. Added sizeof(*hdr) check. HW-gated.
Verified recommended fix
Source-confirmed: sdma_v4_0 firmware ucode payload length/offset from header not validated against firmware blob size, heap OOB read in fw loading loop. Added sizeof(*hdr) check. HW-gated.
Verdict
Source-confirmed: sdma_v4_0 firmware ucode payload length/offset from header not validated against firmware blob size, heap OOB read in fw loading loop. Added sizeof(*hdr) check. HW-gated.
No comments yet.