Summary

dm_helpers_read_local_edid copies a freshly-read EDID blob into dc_sink->dc_edid.raw_edid (512 bytes) using a length derived from the attacker-influenceable edid->extensions byte with no bounds check. A monitor / dongle (or a drm.edid_firmware= override) advertising more than 3 extension blocks causes memmove to write past the 512-byte buffer into the rest of the heap-allocated dc_sink and adjacent slab objects, corrupting edid_caps, dc_container_id, priv, link, ctx, and refcount.

Root cause

amdgpu_dm_helpers.c:583-584:

sink->dc_edid.length = EDID_LENGTH * (edid->extensions + 1);
memmove(sink->dc_edid.raw_edid, (uint8_t *)edid, sink->dc_edid.length);

• edid->extensions is u8 0..255 (drm_edid.h:317)
• EDID_LENGTH is 128 (drm_edid.h:32)
• raw_edid is declared uint8_t raw_edid[DC_MAX_EDID_BUFFER_SIZE] with DC_MAX_EDID_BUFFER_SIZE == 512 (dc_types.h:98,169)

So length can be up to 128*256 == 32768 while the destination is 512 bytes — a write of up to 32256 bytes past the end.

The containing struct dc_sink is heap-allocated via kzalloc(sizeof(*sink)) (dc_sink.c:87) and laid out (dc.h:696-717) as dc_edid then edid_caps then dc_container_id* then dongle_max_pix_clk then void *priv then features_3d[] then link*, ctx*, sink_id, refcount.

drm_do_get_edid (drm_edid.c:1649) reads edid[0x7e] (= extensions) directly into valid_extensions with NO upper bound and only validates per-block checksums (drm_edid.c:1659-1671), so any attacker who can return validly-checksummed EDID blocks (a $5 EDID emulator, a reflashable dummy plug, an MST hub, or the drm.edid_firmware= boot option) controls the count.

The sibling path dc.c:1774 does check if (len > DC_MAX_EDID_BUFFER_SIZE) return NULL; before its memmove(dc_sink->dc_edid.raw_edid, edid, len) at dc.c:1794 — proving the bound is required and was simply omitted in this helper.

Threat model & preconditions

• Attacker position: unprivileged local user with momentary physical access, OR root (for the drm.edid_firmware= boot override / sysfs override).
• Privileges gained or impact: heap corruption. With slab grooming this is a clean arbitrary-write primitive → local-to-kernel privilege escalation to uid 0; the floor is a reliable kernel panic / DoS.
• Required config or capabilities: device amdgpu with Display Manager enabled (default for modern AMD GPUs). No login or special privileges required for the physical-access vector — plugging a display triggers the probe.
• Reachability:
• Physical: plug a malicious display / EDID-emulator dongle into any HDMI/DVI/DP/USB-C-DP-alt-mode port. The kernel's connector-probe work item reads the EDID, and on the very next HPD/reprobe calls dm_helpers_read_local_edid.
• Root: place crafted_edid.bin in the firmware search path, set drm.edid_firmware=<name>, force a connector reprobe.

Proof of concept

PoC source: findings/poc/DF-1837/crafted_edid.bin + findings/poc/DF-1837/trigger.sh

Build & run

# Hardware-free (root):
# 1. Place crafted_edid.bin in the firmware search path as edid/df1837.bin
# 2. Set drm.edid_firmware=df1837 (module parameter or boot option)
# 3. Force a connector reprobe:
sudo sh -c 'echo detect > /sys/class/drm/card0-HDMI-A-1/status'
# Or via xrandr: xrandr --output HDMI-A-1 --off ; xrandr --output HDMI-A-1 --auto

# Hardware (unprivileged physical):
# Flash crafted_edid.bin onto an EDID-emulator HDMI/DP dummy plug
# (AT24C02/AT24C16 I2C EEPROM), plug into the target. Hotplug does the rest.

Expected output

# DoS floor:
BUG: unable to handle kernel paging request at <corrupted addr>
... dm_helpers_read_local_edid+0x.. on the stack
OR
SLUB: slab corruption in kmalloc-1k detected
... near dm_helpers_read_local_edid
OR
kref_put: refcount underflow on dc_sink

For the escalation chain: slab-groom the kmalloc-1k bucket, trigger probe → overflow → corrupt adjacent victim object (struct file-private / DRM-object vtable) → next ioctl on the victim object jumps to a controlled gadget. The full chain is environment-specific; KASAN report or panic backtrace rooted at dm_helpers_read_local_edid validates the bug.

Impact

High-severity heap buffer overflow reachable via: - Any user with momentary physical access to a display connector (no login required) — a $5 EDID-emulator dummy plug suffices. - Root via drm.edid_firmware= / sysfs override.

The overflow writes up to 32256 bytes of attacker-controlled EDID content past the 512-byte raw_edid buffer into dc_sink.edid_caps, dc_container_id, priv, link, ctx, refcount, and adjacent slab objects. Default kernel config; device amdgpu is the standard AMD GPU driver.

Recommended fix

Cap the copy length at DC_MAX_EDID_BUFFER_SIZE and reject EDIDs whose declared extension count would exceed it, mirroring the existing check in dc.c:1774.

--- a/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+++ b/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
@@ -578,11 +578,23 @@ enum dc_edid_status dm_helpers_read_local_edid(
        edid = drm_get_edid(&aconnector->base, ddc);

        if (!edid)
            return EDID_NO_RESPONSE;

-       sink->dc_edid.length = EDID_LENGTH * (edid->extensions + 1);
-       memmove(sink->dc_edid.raw_edid, (uint8_t *)edid, sink->dc_edid.length);
+       /*
+        * edid->extensions is a u8 taken verbatim from the sink; it is
+        * attacker-controlled (crafted monitor / EDID-emulator dongle /
+        * drm.edid_firmware override).  raw_edid is only
+        * DC_MAX_EDID_BUFFER_SIZE (512) bytes, so an extensions count > 3
+        * would overflow the destination.  dc.c:dc_sink_create_from_edid
+        * already enforces this bound; mirror it here.
+        */
+       sink->dc_edid.length =
+           (uint32_t)EDID_LENGTH * (edid->extensions + 1);
+       if (sink->dc_edid.length > DC_MAX_EDID_BUFFER_SIZE) {
+           DRM_ERROR("EDID too large (%u bytes) for buffer (%d)\n",
+                 sink->dc_edid.length, DC_MAX_EDID_BUFFER_SIZE);
+           kfree(edid);
+           return EDID_BAD_INPUT;
+       }
+       memmove(sink->dc_edid.raw_edid, (uint8_t *)edid,
+           sink->dc_edid.length);

        /* We don't need the original edid anymore */
        kfree(edid);

The kfree(edid) is added on the rejection path so the kmalloc'd blob is not leaked. EDID_BAD_INPUT is the existing status enum value (dc_types.h:148). The same bound should be audited in any other caller that writes raw_edid; dc_link.c:841 then iterates sink->dc_edid.length / EDID_BLOCK_SIZE which is now guaranteed safe.

References

• Sibling bound enforcement: dc.c:1774 (if (len > DC_MAX_EDID_BUFFER_SIZE) return NULL;).
• Destination size: dc_types.h:98 (DC_MAX_EDID_BUFFER_SIZE 512), dc_types.h:169 (uint8_t raw_edid[DC_MAX_EDID_BUFFER_SIZE]).
• Source count unbounded: drm_edid.c:1649 (valid_extensions = edid[0x7e] with no upper cap).
• Subsequent iteration over raw_edid: dc_link.c:841.

Timeline

• 2026-07-20 Discovered during automated audit.
• 2026-07-20 Reported to DragonFlyBSD security contact (pending).