In the Linux kernel, the following vulnerability has been resolved:
drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
The framebuffer size calculation fb_size = linebytes * height can
overflow when both values are large (e.g., 46341 * 46341 > INT_MAX).
Since linebytes and height are both int types, the multiplication is
performed as int * int, which results in undefined behavior on overflow.
Use check_mul_overflow() to detect and prevent this overflow, consistent
with the approach used in simpledrm.c and corebootdrm.c.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.4
AV:L - The overflow is in ofdrm_device_create() on the local platform probe path (ofdrm_probe matching Open Firmware compatible=display); it is not reached from network protocols, Bluetooth, USB, or other remote packet handlers.
AC:L - An attacker who supplies OF width/linebytes/height (e.g. 46341x46341) deterministically overflows the int multiply fb_size=linebytes*height; there is no race, layout luck, or other condition outside attacker control.
PR:N - ofdrm_probe runs automatically from the platform bus with no capability check; a crafted display node can be supplied without an OS account via netboot/PXE, QEMU/hypervisor Open Firmware, or firmware, so no privileges on the running system are required.
UI:N - Once a malicious display node is present, framebuffer size is computed during unattended driver probe; no victim mount, file open, or other interactive action is required.
S:U - The overflow and resulting framebuffer mapping errors affect kernel and MMIO state on the same host; this is a standard in-kernel driver defect, not a VM escape, IOMMU bypass, or other cross-authority impact.
C:H - A wrapped fb_size ioremaps a too-small aperture while scanout still uses the attacker-chosen pitch and height, enabling out-of-bounds reads of adjacent ioremap/vmalloc memory; memory-corruption OOB access is High confidentiality.
I:H - The undersized mapping causes out-of-bounds writes through drm_sysfb blit/disable paths and DRM/fbdev clients past the mapped firmware framebuffer, which is an OOB write scored as High integrity impact.
A:H - Accesses past the ioremap'd region cause kernel page-fault oops or panic during probe-time DRM client setup or later modeset/blit, fully denying availability on affected Open Firmware display systems.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The overflow is in ofdrm_device_create() on the local platform probe path (ofdrm_probe matching Open Firmware compatible=display); it is not reached from network protocols, Bluetooth, USB, or other remote packet handlers.
AC:L - An attacker who supplies OF width/linebytes/height (e.g. 46341x46341) deterministically overflows the int multiply fb_size=linebytes*height; there is no race, layout luck, or other condition outside attacker control.
PR:N - ofdrm_probe runs automatically from the platform bus with no capability check; a crafted display node can be supplied without an OS account via netboot/PXE, QEMU/hypervisor Open Firmware, or firmware, so no privileges on the running system are required.
UI:N - Once a malicious display node is present, framebuffer size is computed during unattended driver probe; no victim mount, file open, or other interactive action is required.
S:U - The overflow and resulting framebuffer mapping errors affect kernel and MMIO state on the same host; this is a standard in-kernel driver defect, not a VM escape, IOMMU bypass, or other cross-authority impact.
C:H - A wrapped fb_size ioremaps a too-small aperture while scanout still uses the attacker-chosen pitch and height, enabling out-of-bounds reads of adjacent ioremap/vmalloc memory; memory-corruption OOB access is High confidentiality.
I:H - The undersized mapping causes out-of-bounds writes through drm_sysfb blit/disable paths and DRM/fbdev clients past the mapped firmware framebuffer, which is an OOB write scored as High integrity impact.
A:H - Accesses past the ioremap'd region cause kernel page-fault oops or panic during probe-time DRM client setup or later modeset/blit, fully denying availability on affected Open Firmware display systems.
CVSS 3.1