kernel: drm/amdgpu: Reset IH OVERFLOW_CLEAR bit

A flaw was found in the Linux kernel. The IH OVERFLOWCLEAR bit was not reset...

kernel: drm/amdgpu: validate the parameters of bo mapping operations more clearly

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate the parameters of bo mapping operations more clearly Verify the parameters of amdgpuvmbomap/replacemap/clearingmappings in one common place...

kernel: drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix buffer size in gfxv943init cpcomputemicrocode and rlcmicrocode The function gfxv943initmicrocode in gfxv943.c was generating about potential truncation of output when using the snprintf function. The issue was due...

kernel: drm/amdgpu/mes: fix use-after-free issue

A flaw was found in the Linux kernel. This issue is due to a possible use-after-free in drivers/gpu/drm/amd/amdgpu/amdgpumes.c...

kernel: drm/amdgpu: add error handle to avoid out-of-bounds

A flaw was found in the Linux kernel's drm/amdgpu component. This vulnerability, caused by an out-of-bounds read in the sdmav40irqidtoseq function, could allow a local attacker to read sensitive information from kernel memory. This could lead to information disclosure or a denial of service DoS d...

kernel: drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc

A vulnerability was found in the Linux kernel's amdgpu driver in the amdgpuvceringparsecs function where the size variable is initialized with a pointer that may not be properly set before use. This issue could lead to unpredictable behavior in the system...

kernel: drm/amdgpu: fix deadlock while reading mqd from debugfs

A flaw was found in the drm/amdgpu subsystem in the Linux kernel, involving a deadlock occurring when reading the Memory Queue Descriptor MQD from debugfs. This issue could cause the system to hang during debug operations...

kernel: drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()'

An out-of-bounds access flaw was found in drivers/gpu/drm/amd/amdgpu/amdgpudiscovery.c in the Linux kernel. This issue may lead to a crash...

kernel: drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix a null pointer access when the smcrreg pointer is NULL In certain types of chips, such as VEGA20, reading the amdgpuregssmc file could result in an abnormal null pointer access when the smcrreg pointer is NULL...

kernel: drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: amdgputtmgartbind set gtt bound flag The Linux kernel CVE team has assigned CVE-2024-35817 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051743-CVE-2024-35817-d29b@gregkh/T...

PT-2024-35572

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.65 Description The issue is caused by the ID extraction happening outside of the range of the edid length in the AMD EDID, leading to out-of-bounds issues when using KASAN. This results in a slab-out-of-bound...

UBUNTU-CVE-2024-50221

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Vangogh: Fix kernel memory out of bounds write KASAN reports that the GPU metrics table allocated in vangoghtablesinit is not large enough for the memset done in smucmninitsoftgpumetrics. Condensed report follows:...

CVE-2024-50221 drm/amd/pm: Vangogh: Fix kernel memory out of bounds write

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Vangogh: Fix kernel memory out of bounds write KASAN reports that the GPU metrics table allocated in vangoghtablesinit is not large enough for the memset done in smucmninitsoftgpumetrics. Condensed report follows:...

drm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2)

...

CVE-2024-50221: Out-of-bounds Write

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Vangogh: Fix kernel memory out of bounds write KASAN reports that the GPU metrics table allocated in vangoghtablesinit is not large enough for the memset done in smucmninitsoftgpumetrics. Condensed report follows:...

AZL-54066 CVE-2024-50177 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix a UBSAN warning in DML2.1 When programming phantom pipe, since cursorwidth is explicity set to 0, this causes calculation logic to trigger overflow for an unsigned int triggering the kernel's UBSAN check as...

UBUNTU-CVE-2024-50177

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix a UBSAN warning in DML2.1 When programming phantom pipe, since cursorwidth is explicity set to 0, this causes calculation logic to trigger overflow for an unsigned int triggering the kernel's UBSAN check as...

CVE-2024-50177: Integer Overflow or Wraparound

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix a UBSAN warning in DML2.1 When programming phantom pipe, since cursorwidth is explicity set to 0, this causes calculation logic to trigger overflow for an unsigned int triggering the kernel's UBSAN check as...

amdgpu link_destruct() Data Compromise

The vulnerability of the linkdestruct function in the drivers/gpu/drm/amd/display/dc/link/linkfactory.c file of the amdgpu kernel in the Linux operating system is related to the re-release of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the...

Linux kernel dmub_callback dmub_thread_offload Use-After-Free

The vulnerability of the dmubcallback and dmubthreadoffload functions defined in the drivers/gpu/drm/amd/display/amdgpudm/amdgpudm.h header of the Linux kernel’s CPU is related to insufficient memory allocation, which leads to memory reading beyond the allocated buffer. Exploiting this...