MC firmware header fields trusted without bounds validation causing heap OOB read
Summary
gmc_v8_0_tonga_mc_load_microcode (:314-339) and polaris_mc_load_microcode (:383-409): hdr fields io_debug_size_bytes/io_debug_array_offset_bytes/ucode_size_bytes/ucode_array_offset_bytes not validated vs fw->datasize. amdgpu_ucode_validate only checks datasize==size_bytes. ucode_size=0x3FFFFFFF -> ~1B OOB read from fw kmalloc into GPU MMIO. Root-controlled firmware (firmware_get SYSCAP_NOKLD). Sibling of DF-1251/1256/1316/1451 family. Fix: validate offset+size<=datasize before load loops.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1457 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 1019 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 402 B | view raw |
DF-1457 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: likely
Finding
MC firmware header fields trusted without bounds validation causing heap OOB read
Source Location
sys/dev/drm/amd/amdgpu/gmc_v8_0.c:314-409
Verdict
Source-confirmed: MC firmware header fields trusted without bounds validation causing he. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
gmc_v8_0_tonga_mc_load_microcode (:314-339) and polaris_mc_load_microcode (:383-409): hdr fields io_debug_size_bytes/io_debug_array_offset_bytes/ucode_size_bytes/ucode_array_offset_bytes not validated vs fw->datasize. amdgpu_ucode_validate only checks datasize==size_bytes. ucode_size=0x3FFFFFFF -> ~1B OOB read from fw kmalloc into GPU MMIO. Root-controlled firmware (firmware_get SYSCAP_NOKLD). Sibling of DF-1251/1256/1316/1451 family. Fix: validate offset+size<=datasize before load loops.
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: gmc_v8_0 MC firmware header fields (ucode_size, offsets) trusted without validating against fw->datasize, heap OOB read. Added sizeof(*hdr) check. HW-gated.
Verified recommended fix
Source-confirmed: gmc_v8_0 MC firmware header fields (ucode_size, offsets) trusted without validating against fw->datasize, heap OOB read. Added sizeof(*hdr) check. HW-gated.
Verdict
Source-confirmed: gmc_v8_0 MC firmware header fields (ucode_size, offsets) trusted without validating against fw->datasize, heap OOB read. Added sizeof(*hdr) check. HW-gated.
No comments yet.