DF-3745 — Connector/encoder object-table walks dereference unvalidated VBIOS offsets and indices — OOB heap reads at connector init

Severity: Medium · CWE: CWE-125 Out-of-bounds Read · File: sys/dev/drm/radeon/radeon_atombios.c:537-548, 551-557, 654-656, 682-698, 732-740, 660-672, 772-803

What this is

radeon_get_atom_connector_info_from_object_table() (the DCE4+ connector path) dereferences a web of unvalidated BIOS values: (1) table bases from u16 offsets usStateArrayOffset/usClockInfoArrayOffset/usNonClockInfoArrayOffset/usDisplayPathTableOffset/usConnectorObjectTableOffset/usEncoderObjectTableOffset/usRouterObjectTableOffset (:537-548); (2) the display-path walk accumulates attacker u16 usSize values (:551-557) — two 0x8000 sizes put the record pointer 64 KiB out; (3) per-object usRecordOffset/usSrcDstTableOffset u16 offsets dereferenced immediately (:654-656, :685-698); (4) router src/dst: enum_id runs to *num_dst_objs (u8<=255) then indexes ucMuxState[enum_id] though ucMuxState is UCHAR[2] (atombios.h:4380-4395) — up to 253 B OOB (:732/:740); (5) record chains stepped by ucRecordSize with no image-end bound (:660-672, :772-803). All of this reads past the rdev->bios heap image at boot/attach (values feed connector config; distinct surface from the power-table indices of DF-1200). Harness on guest demonstrates each sub-case. Kernel path unreachable on this guest.

Reproduce

./build.sh    # cc -O1 -g -Wall -o <bin> harness_objtable.c   (DragonFly guest, cc 8.3)
./run.sh      # expected: path walk goes OOB at path 1 (offset 0x6666 > 4096-byte image); record offset 0xFFF0 deref; enum_id=255 vs ucMuxState[2]; chain walks past image end; exit_code=0

The harness replicates the kernel parse arithmetic VERBATIM (cited path:line) against a synthetic crafted-VBIOS buffer with canary-guarded destinations.

Guest / environment

Guest has NO AMD/radeon GPU (virtio-only); /boot/kernel/radeon.ko exists (code shipped in the default install) but cannot attach, so the kernel code path is unreachable at runtime on this guest. Evidence is source-level certainty (path:line traced) plus a verbatim-arithmetic userland harness compiled and executed on the guest (build.log/run.log). See env.txt (uname, cc, kldstat, /boot/kernel/radeon.ko presence).

Fix

validate every BIOS offset/size against the image length before use (needs the bios_size plumbing of DF-3744) — see fix.diff (authored after verification; never applied to sys/).

DF-3745 — Connector/encoder object-table walks dereference unvalidated VBIOS offsets and indices — OOB heap reads at connector init

Severity: Medium · CWE: CWE-125 Out-of-bounds Read · File: sys/dev/drm/radeon/radeon_atombios.c:537-548, 551-557, 654-656, 682-698, 732-740, 660-672, 772-803

What this is

radeon_get_atom_connector_info_from_object_table() (the DCE4+ connector path) dereferences a web of unvalidated BIOS values: (1) table bases from u16 offsets usStateArrayOffset/usClockInfoArrayOffset/usNonClockInfoArrayOffset/usDisplayPathTableOffset/usConnectorObjectTableOffset/usEncoderObjectTableOffset/usRouterObjectTableOffset (:537-548); (2) the display-path walk accumulates attacker u16 usSize values (:551-557) — two 0x8000 sizes put the record pointer 64 KiB out; (3) per-object usRecordOffset/usSrcDstTableOffset u16 offsets dereferenced immediately (:654-656, :685-698); (4) router src/dst: enum_id runs to *num_dst_objs (u8<=255) then indexes ucMuxState[enum_id] though ucMuxState is UCHAR[2] (atombios.h:4380-4395) — up to 253 B OOB (:732/:740); (5) record chains stepped by ucRecordSize with no image-end bound (:660-672, :772-803). All of this reads past the rdev->bios heap image at boot/attach (values feed connector config; distinct surface from the power-table indices of DF-1200). Harness on guest demonstrates each sub-case. Kernel path unreachable on this guest.

Reproduce

./build.sh    # cc -O1 -g -Wall -o <bin> harness_objtable.c   (DragonFly guest, cc 8.3)
./run.sh      # expected: path walk goes OOB at path 1 (offset 0x6666 > 4096-byte image); record offset 0xFFF0 deref; enum_id=255 vs ucMuxState[2]; chain walks past image end; exit_code=0

The harness replicates the kernel parse arithmetic VERBATIM (cited path:line) against a synthetic crafted-VBIOS buffer with canary-guarded destinations.

Guest / environment

Guest has NO AMD/radeon GPU (virtio-only); /boot/kernel/radeon.ko exists (code shipped in the default install) but cannot attach, so the kernel code path is unreachable at runtime on this guest. Evidence is source-level certainty (path:line traced) plus a verbatim-arithmetic userland harness compiled and executed on the guest (build.log/run.log). See env.txt (uname, cc, kldstat, /boot/kernel/radeon.ko presence).

Fix

validate every BIOS offset/size against the image length before use (needs the bios_size plumbing of DF-3744) — see fix.diff (authored after verification; never applied to sys/).

VERDICT — DF-3745

Status: inconclusive (source-certain; harness-reproduced arithmetic; kernel path unreachable on this guest) reproduced: 0 (in-kernel) — harness demonstration: YES Impact on real hardware: Medium — CWE-125 Out-of-bounds Read

Finding

radeon_get_atom_connector_info_from_object_table() (the DCE4+ connector path) dereferences a web of unvalidated BIOS values: (1) table bases from u16 offsets usStateArrayOffset/usClockInfoArrayOffset/usNonClockInfoArrayOffset/usDisplayPathTableOffset/usConnectorObjectTableOffset/usEncoderObjectTableOffset/usRouterObjectTableOffset (:537-548); (2) the display-path walk accumulates attacker u16 usSize values (:551-557) — two 0x8000 sizes put the record pointer 64 KiB out; (3) per-object usRecordOffset/usSrcDstTableOffset u16 offsets dereferenced immediately (:654-656, :685-698); (4) router src/dst: enum_id runs to *num_dst_objs (u8<=255) then indexes ucMuxState[enum_id] though ucMuxState is UCHAR[2] (atombios.h:4380-4395) — up to 253 B OOB (:732/:740); (5) record chains stepped by ucRecordSize with no image-end bound (:660-672, :772-803). All of this reads past the rdev->bios heap image at boot/attach (values feed connector config; distinct surface from the power-table indices of DF-1200). Harness on guest demonstrates each sub-case. Kernel path unreachable on this guest.

Why not reproduced in-kernel

The QEMU guest is virtio-only (no AMD GPU): pciconf -l shows no 1002 device; kldstat shows radeon not loaded. /boot/kernel/radeon.ko exists (the vulnerable code ships in the default install) but cannot attach, so radeon_atombios.c parse paths never execute here. All conclusions are source-level (path:line above) plus the on-guest harness (harness_objtable.c).

Harness result

Command: ./run.sh (after ./build.sh) Expected/observed: path walk goes OOB at path 1 (offset 0x6666 > 4096-byte image); record offset 0xFFF0 deref; enum_id=255 vs ucMuxState[2]; chain walks past image end; exit_code=0 Full logs: build.log, run.log.

Impact / exploit chain

crafted Object_Header table -> OOB pointer arithmetic at radeon_modeset_init -> reads of adjacent kernel heap -> crash (values also propagate into connector/encoder setup)

Fix

validate every BIOS offset/size against the image length before use (needs the bios_size plumbing of DF-3744) — fix.diff.

Honest notes

• DF-3745 does NOT re-report pass-1 findings DF-1198/1199/1200 (power-table state_index mismatch, asic_ss_info underflow, power-table indices) — different functions/tables/fields.
• fix validation not possible on this guest (no hardware); fix.diff is source-authored only.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

VERDICT — DF-3745

Status: inconclusive (source-certain; harness-reproduced arithmetic; kernel path unreachable on this guest) reproduced: 0 (in-kernel) — harness demonstration: YES Impact on real hardware: Medium — CWE-125 Out-of-bounds Read

Finding

radeon_get_atom_connector_info_from_object_table() (the DCE4+ connector path) dereferences a web of unvalidated BIOS values: (1) table bases from u16 offsets usStateArrayOffset/usClockInfoArrayOffset/usNonClockInfoArrayOffset/usDisplayPathTableOffset/usConnectorObjectTableOffset/usEncoderObjectTableOffset/usRouterObjectTableOffset (:537-548); (2) the display-path walk accumulates attacker u16 usSize values (:551-557) — two 0x8000 sizes put the record pointer 64 KiB out; (3) per-object usRecordOffset/usSrcDstTableOffset u16 offsets dereferenced immediately (:654-656, :685-698); (4) router src/dst: enum_id runs to *num_dst_objs (u8<=255) then indexes ucMuxState[enum_id] though ucMuxState is UCHAR[2] (atombios.h:4380-4395) — up to 253 B OOB (:732/:740); (5) record chains stepped by ucRecordSize with no image-end bound (:660-672, :772-803). All of this reads past the rdev->bios heap image at boot/attach (values feed connector config; distinct surface from the power-table indices of DF-1200). Harness on guest demonstrates each sub-case. Kernel path unreachable on this guest.

Why not reproduced in-kernel

The QEMU guest is virtio-only (no AMD GPU): pciconf -l shows no 1002 device; kldstat shows radeon not loaded. /boot/kernel/radeon.ko exists (the vulnerable code ships in the default install) but cannot attach, so radeon_atombios.c parse paths never execute here. All conclusions are source-level (path:line above) plus the on-guest harness (harness_objtable.c).

Harness result

Command: ./run.sh (after ./build.sh) Expected/observed: path walk goes OOB at path 1 (offset 0x6666 > 4096-byte image); record offset 0xFFF0 deref; enum_id=255 vs ucMuxState[2]; chain walks past image end; exit_code=0 Full logs: build.log, run.log.

Impact / exploit chain

crafted Object_Header table -> OOB pointer arithmetic at radeon_modeset_init -> reads of adjacent kernel heap -> crash (values also propagate into connector/encoder setup)

Fix

validate every BIOS offset/size against the image length before use (needs the bios_size plumbing of DF-3744) — fix.diff.

Honest notes

• DF-3745 does NOT re-report pass-1 findings DF-1198/1199/1200 (power-table state_index mismatch, asic_ss_info underflow, power-table indices) — different functions/tables/fields.
• fix validation not possible on this guest (no hardware); fix.diff is source-authored only.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.