CVE-2024-27045: drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix a potential buffer overflow in 'dpdscclockenread()'
Tell snprintf() to store at most 10 bytes in the output buffer instead of 30.
Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/amdgpudm/amdgpudmdebugfs.c:1508 dpdscclockenread() error: snprintf() is printing too much 30 vs 10
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Configuration
In drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c at function dp_dsc_clock_en_read() (line 1508), modify the snprintf() call so it stores at most 10 bytes in the output buffer (instead of 30) to prevent a potential buffer overflow.
Linux kernel (drm/amd/display) snprintf() output length in dp_dsc_clock_en_read() = store at most 10 bytes in the output buffer instead of 30
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27045?
CVE-2024-27045 has been classified with moderate severity due to the potential buffer overflow in the Linux kernel.
How do I fix CVE-2024-27045?
To fix CVE-2024-27045, update to the patched kernel version such as 5.10.223-1 or newer.
Which versions of the Linux kernel are affected by CVE-2024-27045?
CVE-2024-27045 affects Linux kernel versions between 5.9 and 6.8.2.
What is the nature of the vulnerability in CVE-2024-27045?
CVE-2024-27045 is a buffer overflow vulnerability found in 'dp_dsc_clock_en_read()' within the Linux kernel.
Is CVE-2024-27045 present in Debian Linux?
Yes, Debian Linux contains the CVE-2024-27045 vulnerability in its affected kernel versions prior to the fixed versions.