amdgpu FruEeprom OOB

Vulnerability analysis

When the AMD GPU driver reads product information from the GPU's FRU EEPROM, it walks type-length-value fields with open-coded pointer arithmetic that advances the cursor and copies field data without consistently checking that each access stays within the actual buffer length. On truncated or malformed EEPROM data, the parser can read past the end of the allocated buffer, leaking kernel heap memory into driver-internal strings. The fix replaces the open-coded walk with bounded helper functions that verify every cursor advance and data copy against the real data length before touching memory, refusing to proceed if a field would extend past the buffer. The vulnerable path is reached when the driver probes a GPU whose EEPROM contains malformed FRU data, which requires physical access to supply or tamper with the GPU hardware.