CVE-2024-27042: drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()'
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix potential out-of-bounds access in 'amdgpudiscoveryregbaseinit()'
The issue arises when the array 'adev->vcn.vcnconfig' is accessed before checking if the index 'adev->vcn.numvcninst' is within the bounds of the array.
The fix involves moving the bounds check before the array access. This ensures that 'adev->vcn.numvcninst' is within the bounds of the array before it is used as an index.
Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpudiscovery.c:1289 amdgpudiscoveryregbaseinit() error: testing array offset 'adev->vcn.numvcninst' after use.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix potential out-of-bounds access in 'amdgpudiscoveryregbaseinit()'
The Linux kernel CVE team has assigned CVE-2024-27042 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050113-CVE-2024-27042-e812@gregkh/T
— Red Hat
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.23 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.11 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27042?
CVE-2024-27042 has a medium severity level due to the potential for out-of-bounds access.
How do I fix CVE-2024-27042?
To fix CVE-2024-27042, update your Linux kernel to versions 6.6.23, 6.7.11, 6.8.2, or 6.9.
What software is affected by CVE-2024-27042?
CVE-2024-27042 affects multiple versions of the Linux kernel below 6.6.23 and between 6.7 and 6.9.
Is there a patch available for CVE-2024-27042?
Yes, patches are available in the form of updated kernel versions from Red Hat and Debian.
Can CVE-2024-27042 lead to system crashes?
Yes, the out-of-bounds access vulnerability in CVE-2024-27042 could potentially lead to system instability or crashes.