// For flags

CVE-2024-26797

drm/amd/display: Prevent potential buffer overflow in map_hw_resources

Severity Score

7.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Prevent potential buffer overflow in map_hw_resources

Adds a check in the map_hw_resources function to prevent a potential
buffer overflow. The function was accessing arrays using an index that
could potentially be greater than the size of the arrays, leading to a
buffer overflow.

Adds a check to ensure that the index is within the bounds of the
arrays. If the index is out of bounds, an error message is printed and
break it will continue execution with just ignoring extra data early to
prevent the buffer overflow.

Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 map_hw_resources() error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id' 6 <= 7
drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 map_hw_resources() error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id' 6 <= 7

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/display: Previene un posible desbordamiento del búfer en map_hw_resources Agrega una verificación en la función map_hw_resources para evitar un posible desbordamiento del búfer. La función accedía a matrices utilizando un índice que potencialmente podría ser mayor que el tamaño de las matrices, lo que provocaba un desbordamiento del búfer. Agrega una verificación para garantizar que el índice esté dentro de los límites de las matrices. Si el índice está fuera de los límites, se imprime un mensaje de error y, al interrumpirlo, continuará la ejecución ignorando los datos adicionales antes de tiempo para evitar el desbordamiento del búfer. Reportado por smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 error map_hw_resources(): desbordamiento del búfer 'dml2-&gt;v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id' 6 &lt;= 7 controladores/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 error map_hw_resources(): desbordamiento del búfer 'dml2-&gt;v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id' 6 &lt;= 7

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-02-19 CVE Reserved
  • 2024-04-04 CVE Published
  • 2024-04-05 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 >= 6.7 < 6.7.9
Search vendor "Linux" for product "Linux Kernel" and version " >= 6.7 < 6.7.9"
en
Affected
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 >= 6.7 < 6.8
Search vendor "Linux" for product "Linux Kernel" and version " >= 6.7 < 6.8"
en
Affected