Nuclear

Hack.lu2026

Task: a Rust vfio-user PCI device (AMD 1002:6780 'Tahiti') whose attacker-supplied ROM is parsed by the guest kernel's amdgpu driver as a VBIOS; BAR2 is dumped to the attacker. Solution: a malicious ATOM VBIOS with an INIT table PS byte of 0x44 makes atom_op_calltable pass params_size = -1, turning the ATOM_ARG_PS bounds check into a stack OOB read/write, which is used to build a kernel ROP chain (filp_open/kernel_read/ioremap/memcpy_toio) that copies the flag into BAR2.