Magic-map desync across master swap leaves dangling drm_file* in the old master's idr → use-after-free bit-write via DRM_IOCTL_AUTH_MAGIC
Summary
The magic id lives in the allocation-time master's idr but the close-time release removes from the current master - a SETMASTER swap (DRM_ROOT_ONLY here, accidentally safer than upstream) leaves the entry dangling after the drm_file is freed, and AUTH_MAGIC writes authenticated=1 (a single bit at a fixed offset) through the freed pointer. Root-gated setup, unpriv first-opener detonation. Remove-before-swap fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-4972 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.2 KB | view raw |
Fix verification
not_testableConfirmed kernel references
Detail
Exploit chain
fd2 GETMAGIC (id N in M1) -> fd2 SETMASTER (root: master->M2, magic not migrated) -> fd2 close (removes from M2 = no-op) -> fd1 AUTHMAGIC(N) -> 1-bit write into freed drm_file
Evidence (decisive lines)
findings/poc/DF-4972/ (this verdict; full chain in reviewer notes)
Verdict
Root-gated 1-bit UAF write (Low; no DRM device on guest): the magic id lives in the ALLOCATION-TIME master's idr, but drm_master_release removes it from the CLOSE-TIME master - a SETMASTER swap (DRM_ROOT_ONLY in this tree, unlike upstream) leaves the (id -> drm_file*) entry dangling in the old master's idr after the drm_file is kfreed, and any is_master holder of the old master calling AUTH_MAGIC writes authenticated=1 (a single bit at a fixed offset) through the freed pointer into groomable memory. DF-2017's disabled exclusivity keeps the old master alive and lookup-reachable. Remove-from-old-master-before-swap fix.
No comments yet.