CVE-2024-38552: drm/amd/display: Fix potential index out of bounds in color transformation function
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix potential index out of bounds in color transformation function
Fixes index out of bounds issue in the color transformation function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFERFUNCPOINTS).
The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds, an error message is logged and the function returns false to indicate an error.
Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10cmcommon.c:405 cmhelpertranslatecurvetohwformat() error: buffer overflow 'outputtf->tfpts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10cmcommon.c:406 cmhelpertranslatecurvetohwformat() error: buffer overflow 'outputtf->tfpts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10cmcommon.c:407 cmhelpertranslatecurvetohwformat() error: buffer overflow 'outputtf->tfpts.blue' 1025 <= s32max
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.94-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.8.12-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Configuration
Apply the drm/amd/display fix that adds a bounds check for the index 'i' in cm_helper_translate_curve_to_hw_format() so the code does not access transfer function points beyond TRANSFER_FUNC_POINTS; if 'i' is out of bounds, log an error and return false.
Linux kernel (drm/amd/display color transformation) Index bounds check in cm_helper_translate_curve_to_hw_format() = Add check to ensure i is within bounds (TRANSFER_FUNC_POINTS) before accessing transfer function points
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38552?
CVE-2024-38552 has a medium severity level due to potential index out of bounds, which could lead to application crashes.
How do I fix CVE-2024-38552?
To fix CVE-2024-38552, update your Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
What are the affected software versions for CVE-2024-38552?
CVE-2024-38552 affects various versions of the Linux kernel, specifically those within the ranges 4.16 to 4.19.316, 4.20 to 5.4.278, and several others up to 6.9.3.
What causes CVE-2024-38552?
CVE-2024-38552 is caused by an index out of bounds issue in the color transformation function of the Linux kernel.
Is CVE-2024-38552 exploitable?
Yes, CVE-2024-38552 could be exploited under certain conditions that cause the index to exceed its bounds, potentially leading to system instability.