Firmware header fields read without size check after amdgpu_ucode_validate
Summary
sdma_v2_4.c:154 amdgpu_ucode_validate only checks datasize==hdr->size_bytes (amdgpu_ucode.c:251-260). 157 hdr=(sdma_firmware_header_v1_0*)fw->data. 158 reads hdr->header.ucode_version offset 16. 159 reads hdr->ucode_feature_version offset 32 OOB if datasize<36. 167-169 SMU path reads header->ucode_size_bytes offset 24 OOB if datasize<28. ucode_size_bytes feeds fw_size += ALIGN(...,PAGE_SIZE) -> wrap possible -> undersized fw_buf -> memcpy overflow in amdgpu_ucode_init_single_fw. Sibling of DF-1256/1316/1451/1457/1538/1553. CHIP_TOPAZ default SMU load. Fix: check datasize >= sizeof(sdma_firmware_header_v1_0) before field access.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1598 · 4 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | git-apply-able fix for the cited bug | 757 B | view raw |
| VERDICT.md | verdict | source-confirmation analysis | 714 B | ↓ raw |
| build.sh | build-script | N/A (source-only) | 61 B | view raw |
| run.sh | run-script | N/A (source-only) | 87 B | view raw |
DF-1598 VERDICT
Verdict: REPRODUCED (source-confirmed)
Impact: Low (driver-level NULL deref / OOB / leak / DoS — hardware-gated)
Mechanism: sdma_v2_4.c:154 amdgpu_ucode_validate only checks datasize==hdr->size_bytes (amdgpu_ucode.c:251-260). 157 hdr=(sdma_firmware_header_v1_0*)fw->data. 158 reads hdr->header.ucode_version offset 16. 159 r
Citation: sys/dev/drm/amd/amdgpu/sdma_v2_4.c:154-169
Fix: Applied fix.diff — compiles in batch kernel build (rc=0, -Werror).
Verification method: Source-only line-by-line trace of cited path:line. Low-severity driver bug; PoC trigger requires specific hardware or root context. Confirmed the cited vulnerable pattern exists in source.
Fix verification
fixedfix.diff compiled in batch kernel build rc=0 -Werror
fix.diff compiled in batch kernel build rc=0 -Werror
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: firmware header fields read without datasize check (sdma_v2_4.c:154-169)
Verified recommended fix
Source-confirmed: firmware header fields read without datasize check (sdma_v2_4.c:154-169)
Verdict
Source-confirmed: firmware header fields read without datasize check (sdma_v2_4.c:154-169)
No comments yet.