intel_csr_ucode_fini kfree dmc_payload without NULLing pointer: dangling pointer (latent UAF)
Summary
intel_csr_ucode_fini L564 kfree(dev_priv->csr.dmc_payload) no dev_priv->csr.dmc_payload=NULL afterward. Pointer remains dangling. intel_csr_load_program L254 only guards on !dmc_payload so non-NULL dangling pointer causes proceed and deref payload L246/265 use-after-free. Today fini is unload-time only (i915_driver_unload:761/i915_pci_remove:1855) no known post-fini caller so latent. Defense-in-depth: NULL pointer + zero dmc_fw_size after kfree.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1896 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 393 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/dev/drm/i915/intel_csr.c:557: kfree dmc_payload without NULLing pointer (dangling pointer, latent UAF)
Verified recommended fix
Source-confirmed at sys/dev/drm/i915/intel_csr.c:557: kfree dmc_payload without NULLing pointer (dangling pointer, latent UAF)
Verdict
Source-confirmed at sys/dev/drm/i915/intel_csr.c:557: kfree dmc_payload without NULLing pointer (dangling pointer, latent UAF)
No comments yet.