AI Score
Confidence
High
EPSS
Percentile
15.5%
SSVC
Exploitation
none
Automatable
no
Technical Impact
partial
In the Linux kernel, the following vulnerability has been resolved:
drm/edid: In connector_bad_edid() cap num_of_ext by num_blocks read
In commit e11f5bd8228f (“drm: Add support for DP 1.4 Compliance edid
corruption test”) the function connector_bad_edid() started assuming
that the memory for the EDID passed to it was big enough to hold
edid[0x7e] + 1
blocks of data (1 extra for the base block). It
completely ignored the fact that the function was passed num_blocks
which indicated how much memory had been allocated for the EDID.
Let’s fix this by adding a bounds check.
This is important for handling the case where there’s an error in the
first block of the EDID. In that case we will call
connector_bad_edid() without having re-allocated memory based on
edid[0x7e]
.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "e11f5bd8228f",
"lessThan": "a7b45024f66f",
"versionType": "git"
},
{
"status": "affected",
"version": "e11f5bd8228f",
"lessThan": "09f3946bb452",
"versionType": "git"
},
{
"status": "affected",
"version": "e11f5bd8228f",
"lessThan": "97794170b696",
"versionType": "git"
}
],
"programFiles": [
"drivers/gpu/drm/drm_edid.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.7",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "5.10.75",
"versionType": "custom",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.14.14",
"versionType": "custom",
"lessThanOrEqual": "5.14.*"
},
{
"status": "unaffected",
"version": "5.15",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/gpu/drm/drm_edid.c"
],
"defaultStatus": "affected"
}
]