CVE-2024-27042 drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()'

2024-05-0112:54:07

Linux

www.cve.org

linux kernel

potential out-of-bounds access

amdgpu_discovery_reg_base_init

AI Score

6.7

Confidence

Low

EPSS

Percentile

15.5%

JSON

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix potential out-of-bounds access in ‘amdgpu_discovery_reg_base_init()’

The issue arises when the array ‘adev->vcn.vcn_config’ is accessed
before checking if the index ‘adev->vcn.num_vcn_inst’ is within the
bounds of the array.

The fix involves moving the bounds check before the array access. This
ensures that ‘adev->vcn.num_vcn_inst’ is within the bounds of the array
before it is used as an index.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1289 amdgpu_discovery_reg_base_init() error: testing array offset ‘adev->vcn.num_vcn_inst’ after use.

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c"
    ],
    "versions": [
      {
        "version": "a0ccc717c4ab",
        "lessThan": "8f3e68c6a3ff",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "a0ccc717c4ab",
        "lessThan": "b33d4af102b9",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "a0ccc717c4ab",
        "lessThan": "8db10cee51e3",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "a0ccc717c4ab",
        "lessThan": "cdb637d33957",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c"
    ],
    "versions": [
      {
        "version": "5.19",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "5.19",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.6.23",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.7.11",
        "lessThanOrEqual": "6.7.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.8.2",
        "lessThanOrEqual": "6.8.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.9",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]