Executive brief
A vulnerability in the Linux kernel's AMD display driver could allow a local user to cause a system crash. The issue stems from a mathematical error where the system attempts to divide by zero during display calculations. This primarily impacts system availability, potentially leading to a denial-of-service on affected machines using AMD graphics hardware.
Technical details
A divide-by-zero vulnerability exists in the AMD Display Core (DC) component of the Linux kernel DRM driver. Specifically, the function 'get_bytes_per_element' in 'display_rq_dlg_calc' (versions 20v2 and 21) could return a default value of 0. When this return value is subsequently used as a denominator in display-related calculations (such as bytes_per_element_y or bytes_per_element_c), it triggers a kernel panic. The fix involves initializing the default return value to 1 to ensure it is never zero. This issue was identified via Coverity static analysis and affects multiple stable kernel branches. An attacker with local access could potentially trigger this condition to cause a denial-of-service.
Affected products
- Linux Linux Kernel up to 5.10.227, 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.6.55, 6.7 to 6.10.14, 6.11 to 6.11.3
Timeline
- 2024-07-15: other: Patch authored
- 2024-10-21: disclosed: CVE published
- 2024-10-25: advisory: NIST analysis completed
References
- https://git.kernel.org/stable/c/1f9f8186e239222f1c8d3dd73bf3bc6ae86c5e76
- https://git.kernel.org/stable/c/3334ab72cbba55a632f24579cd47c4a4e5e69cda
- https://git.kernel.org/stable/c/4067f4fa0423a89fb19a30b57231b384d77d2610
- https://git.kernel.org/stable/c/8f0abb39c16e719129de10596b3ae3363fa178b4
- https://git.kernel.org/stable/c/a23d6029e730f8a151b1a34afb169baac1274583
- https://git.kernel.org/stable/c/bc00d211da4ffad5314a2043b50bdc8ff8a33724
- https://git.kernel.org/stable/c/c7630935d9a4986e8c0ed91658a781b7a77d73f7