CVE-2024-26660 drm/amd/display: Implement bounds check for stream encoder creation in DCN301

2024-04-0206:22:10

Linux

www.cve.org

linux kernel

vulnerability resolved

buffer overflow

stream encoder

bounds check

dcn301

7.9 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.6%

JSON

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Implement bounds check for stream encoder creation in DCN301

‘stream_enc_regs’ array is an array of dcn10_stream_enc_registers
structures. The array is initialized with four elements, corresponding
to the four calls to stream_enc_regs() in the array initializer. This
means that valid indices for this array are 0, 1, 2, and 3.

The error message ‘stream_enc_regs’ 4 <= 5 below, is indicating that
there is an attempt to access this array with an index of 5, which is
out of bounds. This could lead to undefined behavior

Here, eng_id is used as an index to access the stream_enc_regs array. If
eng_id is 5, this would result in an out-of-bounds access on the
stream_enc_regs array.

Thus fixing Buffer overflow error in dcn301_stream_encoder_create
reported by Smatch:
drivers/gpu/drm/amd/amdgpu/…/display/dc/resource/dcn301/dcn301_resource.c:1011 dcn301_stream_encoder_create() error: buffer overflow ‘stream_enc_regs’ 4 <= 5

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c"
    ],
    "versions": [
      {
        "version": "3a83e4e64bb1",
        "lessThan": "42442f74314d",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "3a83e4e64bb1",
        "lessThan": "efdd665ce1a1",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "3a83e4e64bb1",
        "lessThan": "cd9bd10c59e3",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "3a83e4e64bb1",
        "lessThan": "a938eab9586e",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "3a83e4e64bb1",
        "lessThan": "58fca355ad37",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/gpu/drm/amd/display/dc/resource/dcn301/dcn301_resource.c"
    ],
    "versions": [
      {
        "version": "5.11",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "5.11",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.15.149",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.1.78",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.6.17",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.7.5",
        "lessThanOrEqual": "6.7.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.8",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]