Executive brief
A vulnerability in the Linux kernel's AMD display driver could allow a local user to cause a system crash or potentially gain unauthorized access to sensitive information. The issue occurs during color transformation processes used by AMD graphics hardware. This could impact system stability and data confidentiality on machines using affected AMD GPUs.
Technical details
An improper validation of array index (CWE-129) exists in the AMDGPU display driver component of the Linux kernel. Specifically, the function 'cm_helper_translate_curve_to_hw_format' in 'dcn10_cm_common.c' fails to validate the index 'i' against 'TRANSFER_FUNC_POINTS' before accessing the 'tf_pts' red, green, and blue buffers. A local attacker could exploit this buffer overflow to cause a denial of service (system crash) or potentially execute arbitrary code with kernel privileges. The issue has been resolved by adding bounds checking that logs an error and returns false if the index exceeds the defined limits.
Affected products
- Linux Linux Kernel 4.16 to 4.19.316, 4.20 to 5.4.278, 5.5 to 5.10.219, 5.11 to 5.15.161, 5.16 to 6.1.93, 6.2 to 6.6.33, 6.7 to 6.8.12, 6.9 to 6.9.3
Timeline
- 2024-02-26: other: Patch authored
- 2024-06-16: patched: Patch committed to stable tree
- 2024-06-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/04bc4d1090c343025d69149ca669a27c5b9c34a7
- https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123
- https://git.kernel.org/stable/c/4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86
- https://git.kernel.org/stable/c/604c506ca43fce52bb882cff9c1fdf2ec3b4029c
- https://git.kernel.org/stable/c/63ae548f1054a0b71678d0349c7dc9628ddd42ca
- https://git.kernel.org/stable/c/7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29
- https://git.kernel.org/stable/c/98b8a6bfd30d07a19cfacdf82b50f84bf3360869