linux_hexdump() memcmp over-reads up to rowsize-1 bytes past the kmalloc'd ring snapshot on the final partial row (print_request_ring path)
Summary
DragonFly's local reimplementation of print_hex_dump compares a full rowsize=32 bytes at every row including the final partial one, ignoring that only len-pos bytes remain. Via print_request_ring the buffer is a kmalloc snapshot of the request's ring contents where size is typically NOT a multiple of 32 - the memcmp reads up to 31 bytes past the allocation. The bytes are never printed; the only observable is the '*' repeat-marker decision - a 1-bit equality oracle, on paths gated by debugfs/error-capture (root) or a GPU hang. The other caller passes PAGE_SIZE (exact multiple of 32) and is safe. Clamp-the-memcmp fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4246 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 182 B | ↓ raw | |
| verdict.json | file | 1.0 KB | view raw |
DF-4246 — i915 linux_hexdump partial-row memcmp over-read
1-bit equality oracle, <=31 bytes past the ring snapshot, debug/error paths. Hardware-gated. PoC skipped per contract.
Fix verification
not_testableclamp the memcmp and row extent to min(rowsize, len-pos) with n==rowsize gate
source-only
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
intel_engine_cs.c:1261 memcmp(prev, buf+pos, rowsize) with only len-pos valid; :1437 caller with len%32!=0
Verdict
source-verified; hardware-gated (no Intel GPU on audit guest; Low/Info-class)
No comments yet.