⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1895

parse_csr_fw never validates fw->datasize before indexing fw->data: multiple OOB-read paths

Summary

parse_csr_fw indexes fw->data at 4 computed offsets (css_header L297 offset 0; package_header L341 offset 132; dmc_header L376 offset 132+256+dmc_offset; memcpy L425 +128) but NEVER compares against fw->datasize. Sibling GuC/HuC parser intel_uc_fw.c:71 explicitly guards if(fw->datasize<sizeof(uc_css_header)) before any deref; CSR has no equivalent. (a) 16-byte blob: css_header->version L306 at offset 100 OOB by ~84 bytes. (b) package_header->num_entries L353 raw uint32_t iterated without bounding to ARRAY_SIZE(fw_info)=20; num_entries>20 reads past fw_info[20] into fw->data OOB; very large num_entries spins loop faulting. (c) dmc_offset*=4 L372 wraps mod 2^32 then readcount+=dmc_offset L373 wraps; readcount used directly as &fw->data[readcount] L376/L425 attacker-chosen offset OOB read. Root-only trigger. Same anti-pattern intel_uc_fw.c was patched to avoid. Fix: add datasize guards before each structural deref mirroring intel_uc_fw.c.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1895 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 1016 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.5 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1895 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/drm/i915/intel_csr.c:297-425. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

i915 (not in GENERIC, no Intel GFX HW in guest). Source: parse_csr_fw indexes fw->data at 4 computed offsets (css_header L297; package_header L341; dmc_header L376; memcpy L425) but never compares against fw->datasize. Forged/corrupt DMC firmware can craft header_len/num_entries/fw_size that index past the blob.

Add fwsize variable; reject firmware shorter than the sum of headers; bounds-check final memcpy.

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1895/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

Add fwsize variable; reject firmware shorter than the sum of headers; bounds-check final memcpy against fw->datasize. Full git-apply-able diff in findings/poc/DF-1895/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/drm/i915/intel_csr.c:297-425. i915 (not in GENERIC, no Intel GFX HW in guest). parse_csr_fw indexes fw->data at 4 computed offsets (css_header L297; package_header L341; dmc_header L376; memcpy L425) but NEVER compares against fw->datasize. Forged/corrupt DMC firmware can craft header_len/num_entries/fw_size that index past the blob. HW gated.