DF-4885
check_atom_bios() off-by-one/out-of-bounds heap reads: size==0x49 accepted then bios[0x49] read; memcmp reads up to 4 bytes past the buffer when bios_header_start+4==size
Summary
Comparison-only 1-4 byte slab-interior OOB reads (cannot fault, never disclosed); upstream-inherited hardening. Tighten-both-guards fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4885 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 878 B | view raw |
Fix verification
not_testableper-fix-DF-4885
Confirmed kernel references
Detail
Exploit chain
none - comparison-only OOB reads
Evidence (decisive lines)
findings/poc/DF-4885/ (this verdict)
Verdict
Hardening only (no leak channel, no fault path): the guard is size < 0x49 but bios[0x49] is then read (one past a 0x49-byte buffer, reachable via a crafted VFCT ImageLength); separately size < tmp admits tmp==size and the 4-byte memcmp reads up to 4 past the end. Both reads are slab-interior on the DF allocator (cannot fault) and feed only a validity branch - never disclosed to userspace. Upstream-inherited. Tighten-both-guards fix.
No comments yet.