drm addmap/rmmap validation gaps: unbounded _DRM_SCATTER_GATHER offset, x86_64 offset-wrap check compiled out, RM_MAP lacks ownership check (tokens enumerable via unauthenticated GET_MAP)
Summary
Defense-in-depth gaps: SG maps take a raw user offset with no bound vs the sg table size; the offset+size overflow sanity check is compiled out on x86_64; rmmap removes any matching _DRM_REMOVABLE map with no ownership check while GET_MAP is DRM_UNLOCKED (tokens enumerable unprivileged). Exploitation is gated TODAY by a functional units bug (drm_mmap hash keys are byte offsets while addmap stores page numbers - no legacy map can ever be mmapped), which also accidentally gates the classic rmmap-vs-mmap UAF family. If that units bug is ever fixed, these become an unprivileged UAF-on-mapped-pages primitive. Bound + ownership + units-unification fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4282 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| README.md | file | 238 B | ↓ raw | |
| verdict.json | file | 784 B | view raw |
DF-4282
No DRM device on audit guest - PoC skipped per contract. Source citations in the pass-2 result block.
Fix: bound SG offsets, keep the wrap check on all 64-bit arches, require master match in rmmap, unify mmap lookup key units
Fix verification
not_testablebound SG offsets, keep the wrap check on all 64-bit arches, require master match in rmmap, unify mmap lookup key units
source-only
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
source-only; full path:line trace in pass-2 result block
Verdict
source-verified; no DRM device nodes on audit guest
No comments yet.