Executive Summary

This vulnerability exists in the Linux kernel's AMD display driver, specifically in the handling of VBIOS record-chain walk loops within bios_parser.c and bios_parser2.c.

The loops use an infinite for(;;) structure that only terminates when encountering a specific sentinel value (0xFF record_type) or a zero record_size. If a malformed VBIOS image lacks this terminator record, the loop can iterate indefinitely, potentially hundreds of thousands of times with a record_size of 1.

During these excessive iterations, especially near the BIOS image boundary, the code may perform out-of-bounds reads due to struct casts beyond the validated 2-byte header.

The fix caps all 14 record-chain walk loops to a maximum of 256 iterations (BIOS_MAX_NUM_RECORD) to prevent unbounded iteration.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the Linux kernel to perform unbounded iterations when parsing a malformed VBIOS image, potentially leading to excessive CPU usage or system instability during probe time.

Additionally, out-of-bounds reads near the BIOS image boundary could lead to undefined behavior, which might be exploitable for information disclosure or other security issues.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by capping all 14 record-chain walk loops in the Linux kernel's drm/amd/display code to a maximum of 256 iterations to prevent unbounded iteration caused by malformed VBIOS images.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes the fix (commit 95700a3d660287ed657d6892f7be9ffc0e294a93) which implements this cap.

Useful 0 Not Useful 0