panthor BuildInfo OOB

Vulnerability analysis

The Panthor DRM driver's firmware build-info parser checks whether a metadata region fits inside the firmware image by adding two header values together, but the addition can wrap around and allow an invalid range to pass validation. The parser also reads an expected text prefix and looks for a trailing null byte without first confirming the metadata is large enough to hold them, so a malformed or too-small metadata field can cause an out-of-bounds read or an arithmetic underflow. The fix switches to a subtraction-based check that cannot overflow, and refuses metadata that is too short to contain the expected prefix and ending null byte. An attacker can reach this only by supplying a malicious firmware image, which requires root-level access to replace the file the driver loads, and only affects systems with ARM Mali GPU hardware using the Panthor driver.