⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1875

Unvalidated PSP firmware header fields cause heap OOB write in fw_pri_buf (sysdrv + sos load) — variant of DF-1838 for Vega20/Navi10

Summary

psp_v11_0_init_microcode L122-131 reads ucode_size_bytes sos_size_bytes ucode_array_offset_bytes sos_offset_bytes straight from on-disk PSP firmware header into uint32_t fields never bounds-checks any. amdgpu_ucode_validate only verifies fw->datasize==hdr->size_bytes all other fields attacker-controlled. Subtraction ucode_size_bytes-sos_size_bytes L126-127 underflows when sos>ucode -> ~4GB sys_bin_size. bootloader_load_sysdrv L168 memcpy(fw_pri_buf,sys_start_addr,sys_bin_size) into 1MB buffer (PSP_1_MEG amdgpu_psp.c:350-354). bootloader_load_sos L209 memcpy(fw_pri_buf,sos_start_addr,sos_bin_size) raw hdr->sos_size_bytes no upper bound. sys_start_addr L128 = hdr+ucode_array_offset_bytes pointer can be > firmware blob. sos_start_addr L130 = sys_start_addr+sos_offset_bytes unbounded. Same class as DF-1838/1839 psp_v3_1.c but for Vega20/Navi10. Root-only trigger via firmware path. Fires on every PSP init (boot/kldload/resume/reset). Fix: validate header fields vs fw_size and PSP_1_MEG before use.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1875 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 918 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.6 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1875 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/drm/amd/amdgpu/psp_v11_0.c:122-209. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

amdgpu (not in GENERIC, no AMD HW). Source: psp_v11_0_init_microcode reads ucode_size_bytes/sos_size_bytes/ucode_array_offset_bytes/sos_offset_bytes directly from on-disk PSP firmware header into uint32_t fields; never bounds-checks. amdgpu_ucode_validate only verifies fw->datasize==size_bytes. Forged/corrupt firmware can craft offsets that index past the loaded blob.

Add bounds check rejecting firmware whose array_offset + sos_offset + sos_size exceeds sos_fw->size.

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1875/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

Add bounds check rejecting firmware whose array_offset + sos_offset + sos_size exceeds sos_fw->datasize. Full git-apply-able diff in findings/poc/DF-1875/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/drm/amd/amdgpu/psp_v11_0.c:122-209. amdgpu (not in GENERIC, no AMD HW). psp_v11_0_init_microcode reads ucode_size_bytes/sos_size_bytes/ucode_array_offset_bytes/sos_offset_bytes directly from on-disk PSP firmware header without bounds-checks. amdgpu_ucode_validate only verifies fw->datasize==size_bytes. Forged firmware can craft offsets past the loaded blob. HW gated.