CVE-2024-26660CWE-125

CVE-2024-26660

High · published April 2, 2024

CVSS v3.1
7.0
EPSS
0%
Percentile
17.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Implement bounds check for stream encoder creation in DCN301

'stream_enc_regs' array is an array of dcn10_stream_enc_registers

structures. The array is initialized with four elements, corresponding

to the four calls to stream_enc_regs() in the array initializer. This

means that valid indices for this array are 0, 1, 2, and 3.

The error message 'stream_enc_regs' 4 <= 5 below, is indicating that

there is an attempt to access this array with an index of 5, which is

out of bounds. This could lead to undefined behavior

Here, eng_id is used as an index to access the stream_enc_regs array. If

eng_id is 5, this would result in an out-of-bounds access on the

stream_enc_regs array.

Thus fixing Buffer overflow error in dcn301_stream_encoder_create

reported by Smatch:

drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn301/dcn301_resource.c:1011 dcn301_stream_encoder_create() error: buffer overflow 'stream_enc_regs' 4 <= 5

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00266 · 17.8th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2024-04-02T11:15Z
Affected products (7)
ProductVersionsFixed in
linux/linux_kernel≥ 5.11, < 5.15.1495.15.149
linux/linux_kernel≥ 5.16, < 6.1.786.1.78
linux/linux_kernel≥ 6.2, < 6.6.176.6.17
linux/linux_kernel≥ 6.7, < 6.7.56.7.5
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (10)
EPSS history
Timeline
  • 02 APR 06:22Z
    drm/amd/display: Implement bounds check for stream encoder creation in DCN301
    cvelistv5