amdgpu_ucode_print_* helpers read version-dispatched sub-header fields (up to +156) with no blob-size check: unconditional heap OOB read on short crafted firmware, distinct sink from DF-1946 that survives its proposed minimum-size fix
Summary
The print helpers dispatch on the attacker-controlled version and load sub-struct fields via container_of with no size check - and DRM_DEBUG expands to a real variadic call so the loads run unconditionally on every attach. A 33-byte blob passes validate (and a >=32 minimum fix); rlc 2.1 reads +108..155 (~124B past the buffer); mc/smc/gfx/sdma same shape. dmesg-gated heap leak + page-boundary panic ceiling. Root-placed fw threat model; hw-gated. Per-branch size-floor fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4880 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.3 KB | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
root-placed 40-byte amdgpufw_*_rlc claiming v2.1 -> print helper loads fields at +108..155 of a 40-byte allocation -> adjacent heap to dmesg under drm.debug
Evidence (decisive lines)
findings/poc/DF-4880/ (this verdict)
Verdict
Hardware-gated (no AMD GPU on guest): each amdgpu_ucode_print_* helper dispatches on the attacker-controlled header_version and container_of's into a versioned sub-struct then loads its fields - DRM_DEBUG expands to a real variadic call so the loads EXECUTE UNCONDITIONALLY on every attach/resume (drm.debug only gates printing). A 33-byte crafted blob with size_bytes==datasize passes validate and even a datasize>=32 minimum-size fix; claiming rlc 2.1 reads offsets 108..155 (~124 bytes past the kmalloc'd buffer). Same shape for mc(+36)/smc(+32)/gfx(+36)/sdma(+52). Values surface to dmesg only with drm.debug (heap info leak); page-boundary panic possible. Distinct sink from DF-1946 that survives its proposed minimum fix. Per-branch size-floor-gate fix.
No comments yet.