CVE-2024-27008: drm: nv04: Fix out of bounds access
In the Linux kernel, the following vulnerability has been resolved:
drm: nv04: Fix out of bounds access
The Linux kernel CVE team has assigned CVE-2024-27008 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050148-CVE-2024-27008-5964@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
drm: nv04: Fix out of bounds access
When Output Resource (dcb->or) value is assigned in fabricatedcboutput(), there may be out of bounds access to dacusers array in case dcb->or is zero because ffs(dcb->or) is used as index there. The 'or' argument of fabricatedcboutput() must be interpreted as a number of bit to set, not value.
Utilize macros from 'enum nouveauor' in calls instead of hardcoding.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27008?
CVE-2024-27008 has been classified as a medium-severity vulnerability in the Linux kernel.
How do I fix CVE-2024-27008?
To remediate CVE-2024-27008, update your Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
Which Linux kernel versions are affected by CVE-2024-27008?
CVE-2024-27008 affects multiple versions of the Linux kernel, including the versions mentioned above.
What is the nature of the vulnerability in CVE-2024-27008?
CVE-2024-27008 involves an out-of-bounds access to the dac_users array when the Output Resource value is zero.
Can CVE-2024-27008 lead to further issues in the system?
Yes, CVE-2024-27008 could potentially lead to system instability or exploitation if not addressed promptly.