In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: fix firmware control interface bounds checks
panthor_init_cs_iface() and panthor_init_csg_iface() validate firmware
control interface offsets with 32-bit arithmetic and the size of the host
wrapper structures. The offsets are derived from firmware-provided strides,
so the arithmetic can wrap before the bounds check, and the host wrapper
size is not the size of the firmware control interface being mapped.
Use 64-bit arithmetic for the computed offsets and validate against the
actual firmware control interface structure sizes with subtraction-based
bounds checks. Also validate that the shared section is large enough for
the global control interface before using it.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8
AV:L - The 32-bit stride overflow is reached only on the local panthor probe path (panthor_probe → panthor_device_init → panthor_fw_init → panthor_fw_start → panthor_fw_init_ifaces → panthor_init_csg_iface/panthor_init_cs_iface) when mapping firmware-provided group_stride/stream_stride from mali_csffw.bin; no network, Bluetooth, or USB handler feeds those fields.
AC:L - Firmware fully controls group_stride, stream_stride, and group_num (MIN_CSGS is 3, so csg_idx>=1 always runs). A crafted stride that places the u32 offset near 2^32 makes offset+sizeof wrap to a small value and pass the bounds check deterministically, with no race or attacker-uncontrollable timing.
PR:L - The parser applies no capability check to firmware contents. On Mali CSF Android phones, Chromebooks, and embedded boards, mali_csffw.bin commonly lives on vendor/firmware partitions writable by local non-root system or vendor service accounts, which is sufficient to plant the crafted blob before driver probe.
UI:N - Once the crafted firmware is in place, panthor_fw_init_ifaces() runs automatically at driver probe and caches the resulting interface pointers; no separate victim action such as opening a file, mounting a filesystem, or using /dev/dri is required to trigger the overflow.
S:U - The bug corrupts kernel memory past the firmware shared-section vmap and can enable local privilege escalation within the host kernel; it does not cross a VM, IOMMU, or sandbox boundary such as a KVM guest-to-host escape.
C:H - A wrapped u32 iface_offset near 2^32 yields kmap plus a ~4GiB out-of-bounds control pointer; the kernel then reads panthor_fw_control_iface fields (input_va, output_va, stream_num, stream_stride, features) from that address, disclosing kernel memory rather than a few bounded bytes.
I:H - Those OOB control pointers are cached for the device lifetime and consumed by scheduler, job-IRQ, and GROUP_CREATE paths that write panthor_fw_input_iface structures and allocate suspend buffers from control->suspend_size, enabling out-of-bounds kernel writes and control-flow hijacking.
A:H - Dereferencing kmap plus a wrapped near-4GiB offset can immediately oops or panic if the region is unmapped, and a corrupted firmware interface leaves the Mali GPU unusable; the same path is hit on every probe or firmware boot until the blob is removed.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The 32-bit stride overflow is reached only on the local panthor probe path (panthor_probe → panthor_device_init → panthor_fw_init → panthor_fw_start → panthor_fw_init_ifaces → panthor_init_csg_iface/panthor_init_cs_iface) when mapping firmware-provided group_stride/stream_stride from mali_csffw.bin; no network, Bluetooth, or USB handler feeds those fields.
AC:L - Firmware fully controls group_stride, stream_stride, and group_num (MIN_CSGS is 3, so csg_idx>=1 always runs). A crafted stride that places the u32 offset near 2^32 makes offset+sizeof wrap to a small value and pass the bounds check deterministically, with no race or attacker-uncontrollable timing.
PR:L - The parser applies no capability check to firmware contents. On Mali CSF Android phones, Chromebooks, and embedded boards, mali_csffw.bin commonly lives on vendor/firmware partitions writable by local non-root system or vendor service accounts, which is sufficient to plant the crafted blob before driver probe.
UI:N - Once the crafted firmware is in place, panthor_fw_init_ifaces() runs automatically at driver probe and caches the resulting interface pointers; no separate victim action such as opening a file, mounting a filesystem, or using /dev/dri is required to trigger the overflow.
S:U - The bug corrupts kernel memory past the firmware shared-section vmap and can enable local privilege escalation within the host kernel; it does not cross a VM, IOMMU, or sandbox boundary such as a KVM guest-to-host escape.
C:H - A wrapped u32 iface_offset near 2^32 yields kmap plus a ~4GiB out-of-bounds control pointer; the kernel then reads panthor_fw_control_iface fields (input_va, output_va, stream_num, stream_stride, features) from that address, disclosing kernel memory rather than a few bounded bytes.
I:H - Those OOB control pointers are cached for the device lifetime and consumed by scheduler, job-IRQ, and GROUP_CREATE paths that write panthor_fw_input_iface structures and allocate suspend buffers from control->suspend_size, enabling out-of-bounds kernel writes and control-flow hijacking.
A:H - Dereferencing kmap plus a wrapped near-4GiB offset can immediately oops or panic if the region is unmapped, and a corrupted firmware interface leaves the Mali GPU unusable; the same path is hit on every probe or firmware boot until the blob is removed.
CVSS 3.1