All fixed-struct VBIOS table reads discard the table size and dereference full structs after checking only frev/crev — OOB read past truncated ATOM data tables
Summary
Every data-table accessor fetches via smu_atom_get_data_table(..., NULL, NULL, NULL) - deliberately discarding the size - then casts the ROM pointer to a full fixed struct (the ~150-byte smc_dpm_info walk, the asic_profiling v4.2 tail, firmwareinfo v3_2) after validating only the revision bytes; amdgpu_atom_parse_data_header performs no bounds validation at all. A crafted VBIOS declaring small structuresize or pointing near the ROM end yields kernel OOB reads (garbage power tables / fault-on-read). Distinct mechanism from DF-1815..1817 (fixed-offset casts, 6 sites). Fetch-and-validate-size fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4703 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.4 KB | view raw |
Fix verification
not_testablenot_testable: hardware/boot-flag gated
fix in finding markdown
Confirmed kernel references
Detail
Exploit chain
[]
Evidence (decisive lines)
Every data-table accessor discards the size out-param and casts the ROM pointer to a full fixed struct after checking only frev/crev - a table declaring a small structuresize (or pointing near the ROM end) yields OOB reads; the ~150-byte smc_dpm_info walk is the biggest. Same trust model as DF-1815..1817 but a distinct mechanism (fixed-offset casts at 6 sites pass 1 did not file). Fetch-and-validate-the-size fix.
Verdict
not_run: no AMD GPU on guest; mechanism by inspection of smu_helper.c/atom.c (no bounds validation of data_start/size)
No comments yet.