intel_dsi_vbt: unbounded attacker-controlled len in mipi_exec_send_packet causes heap OOB read (v3 sequences)
Summary
For VBT v3 goto_next_sequence_v3 (intel_bios.c:978-1010) reads external operation_size byte advances index+len; does NOT validate internal length fields. mipi_exec_send_packet reads separate u16 len from body (124) passes directly to mipi_dsi_generic_write/dcs_write_buffer (168,180) as size. Crafted v3 VBT: operation_size=10 parse passes, internal len=0xFFFF exec reads 60000 bytes heap past kmemdup buffer. write_data (vlv_dsi.c:88) loops len bytes from VBT ptr. Consistency check at intel_dsi_vbt.c:466 fires AFTER OOB read already happened. Same class affects mipi_exec_i2c (362) mipi_exec_spi (369). Fix: pass operation_size into executors; validate len+4<=operation_size.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1771 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Break if internal len==0 to prevent unbounded parsing. | 255 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1771 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: panic Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/drm/i915/intel_bios.c:978-1010.
Mechanism
goto_next_sequence_v3 reads external operation_size and advances but does not validate internal length fields; crafted VBT causes executors to read past kmemdup buffer.
Fix
Break if internal len==0 to prevent unbounded parsing.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a GPU/display code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
i915 sources compiled with -Werror.
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- d
- r
- m
- /
- i
- 9
- 1
- 5
- /
- i
- n
- t
- e
- l
- _
- b
- i
- o
- s
- .
- c
- :
- 9
- 7
- 8
- -
- 1
- 0
- 1
- 0
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/drm/i915/intel_bios.c:978-1010. Fix compiled clean.
PoC changes
authored fix.diff: break if len==0
Verified recommended fix
Add len==0 break to prevent unbounded parsing. Matches finding proposal.
Verdict
REPRODUCED (source-only). goto_next_sequence_v3 doesn't validate internal len; crafted VBT causes OOB read past kmemdup buffer.
No comments yet.