⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-1951

Kernel heap info leak: uninitialized BIOS buffer exposed to unprivileged userspace via AMDGPU_INFO_VBIOS_IMAGE ioctl on ATRM path

Summary

amdgpu_atrm_get_bios L338 adev->bios=kmalloc(size=256KB,M_DRM,GFP_KERNEL=M_WAITOK|M_CACHEALIGN) NO M_ZERO. L344-351 loop fills only portion ATRM returns (typically 64-128KB); when VBIOS<256KB amdgpu_atrm_call returns ret<ATRM_BIOS_PAGE loop breaks tail never written. L353 check_atom_bios inspects first ~0x49 bytes passes regardless. L357 adev->bios_size=size=262144 unconditionally reports full 256KB. Sink: AMDGPU_INFO_VBIOS_IMAGE ioctl amdgpu_kms.c:796-806 DRM_AUTH|DRM_RENDER_ALLOW L1207 copy_to_user(adev->bios+offset,min(size,bios_size-offset)); offset beyond filled region accepted because inflated bios_size. Also debugfs seq_write L896. Any unpriv local user render node: read up to ~192KB uninitialized kernel heap per GPU. Leaked: pointers KASLR bypass task_struct creds crypto material. Triggers every boot VBIOS<256KB common case. Fix: kzalloc + bios_size=actual filled count.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-1951 · 2 files
FileTypeDescriptionSize
fix.diff suggested-fix git-apply-able unified diff; validated as part of combined 41-finding kernel build (rc=0, -Werror clean) 452 B view raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation 1.6 KB ↓ raw
VERDICT.md verdict source-only confirmation + HW/module gating explanation
↓ download raw

DF-1951 Verification

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (HW/module gated).

The cited defect exists in the audited source at sys/dev/drm/amd/amdgpu/amdgpu_bios.c:338-357. Reproduction on the running guest is not possible because the affected code path is gated behind hardware that is not present in the audit QEMU/KVM guest (no AMD/i915 GPU, no LSI MegaRAID, no MMC/SDHCI controller, no FireWire, no ATAPI floppy, etc.) and/or lives in a kernel module that is not loaded on the GENERIC-running guest.

Mechanism (source-only confirmation)

amdgpu (not in GENERIC, no AMD HW). Source: amdgpu_atrm_get_bios at L338 adev->bios=kmalloc(size=256KB, M_DRM, GFP_KERNEL=M_WAITOK|M_CACHEALIGN) — NO M_ZERO. L344-351 loop fills only the portion ATRM returns (typically 64-128KB). When VBIOS<256KB, amdgpu_atrm_call returns ret<ATRM_BIOS_PAGE, loop breaks. The unfilled tail contains uninitialized kernel heap, exposed to userspace via /dev/mem or AtomBios parser.

memset(adev->bios, 0, size) after the kmalloc (or use M_ZERO).

The full git apply-able diff lives in fix.diff in this folder; it was applied as part of a single combined 41-finding kernel build that compiled cleanly (rc=0, -Werror clean) — see ../fix_build_summary.txt.

Build validation

  • git apply --check on this fix.diff: OK
  • Combined kernel build (X86_64_GENERIC, INVARIANTS ON) with all 41 findings' fix.diffs applied: rc=0, no warnings, no errors.
  • The patched kernel was not booted/run because the affected code path requires hardware that the audit guest does not have.

Confirmed kernel references

Detail

Exploit chain

none — non-corruption classes (info leak / DoS / div0 / logic) or HW/module gated. No memory-corruption primitive reachable from userspace on this guest.

Evidence (decisive lines)

Source-only confirmation. Combined kernel build with all 41 fix.diffs applied: === NK_DONE rc=0 === at Wed Jul 22 18:05:21 UTC 2026 (no errors, no warnings). See findings/poc/fix_build_summary.txt.

PoC changes

Authored findings/poc/DF-1951/fix.diff (minimal targeted guard). VERDICT.md and manifest.json written. fix.diff validated by combined build.

Verified recommended fix

memset(adev->bios, 0, size) after the kmalloc (or use M_ZERO). Full git-apply-able diff in findings/poc/DF-1951/fix.diff; validated as part of combined 41-finding kernel build (rc=0).

Verdict

SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME. The cited defect exists at sys/dev/drm/amd/amdgpu/amdgpu_bios.c:338-357. amdgpu (not in GENERIC, no AMD HW). amdgpu_atrm_get_bios L338 adev->bios=kmalloc(size=256KB, M_DRM, GFP_KERNEL=M_WAITOK|M_CACHEALIGN) NO M_ZERO. L344-351 loop fills only the portion ATRM returns (typically 64-128KB). When VBIOS<256KB, amdgpu_atrm_call returns ret<ATRM_BIOS_PAGE, loop breaks; unfilled tail contains uninitialized kernel heap, exposed to userspace via /dev/mem or AtomBios parser. HW gated.