CVE-2024-53108: drm/amd/display: Adjust VSDB parser for replay feature
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Adjust VSDB parser for replay feature
At some point, the IEEE ID identification for the replay check in the AMD EDID was added. However, this check causes the following out-of-bounds issues when using KASAN:
[ 27.804016] BUG: KASAN: slab-out-of-bounds in amdgpudmupdatefreesynccaps+0xefa/0x17a0 [amdgpu] [ 27.804788] Read of size 1 at addr ffff8881647fdb00 by task systemd-udevd/383
...
[ 27.821207] Memory state around the buggy address: [ 27.821215] ffff8881647fda00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.821224] ffff8881647fda80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.821234] >ffff8881647fdb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.821243] ^ [ 27.821250] ffff8881647fdb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.821259] ffff8881647fdc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.821268] ==================================================================
This is caused because the ID extraction happens outside of the range of the edid lenght. This commit addresses this issue by considering the amdvsdbblock size.
(cherry picked from commit b7e381b1ccd5e778e3d9c44c669ad38439a861d8)
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53108?
CVE-2024-53108 is considered a high-severity vulnerability in the Linux kernel related to out-of-bounds issues.
How do I fix CVE-2024-53108?
To address CVE-2024-53108, upgrade your Linux kernel to a version above 6.12-rc7 or apply the security patch provided by your distribution.
What versions of the Linux kernel are affected by CVE-2024-53108?
CVE-2024-53108 affects Linux kernel versions between 6.7 and 6.11.10, as well as 6.12 release candidates 1 to 7.
What impact does CVE-2024-53108 have on system security?
CVE-2024-53108 can lead to potential exploitation that may cause system instability or unauthorized access.
Is CVE-2024-53108 a specific issue in AMD hardware?
Yes, CVE-2024-53108 specifically relates to an issue in the AMD EDID handling within the Linux kernel.