drm/amd/display: Adjust VSDB parser for replay feature (Linux Linux)

CVE-2024-53108
HIGH 7.3

En bref

Source
NVD
EPSS
EPSS 0.24 % · centile 16 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Modified

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Adjust VSDB parser for replay feature At some point, the IEEE ID identification for the replay check in the AMD EDID was added. However, this check causes the following out-of-bounds issues when using KASAN: [ 27.804016] BUG: KASAN: slab-out-of-bounds in amdgpu_dm_update_freesync_caps+0xefa/0x17a0 [amdgpu] [ 27.804788] Read of size 1 at addr ffff8881647fdb00 by task systemd-udevd/383 ... [ 27.821207] Memory state around the buggy address: [ 27.821215] ffff8881647fda00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.821224] ffff8881647fda80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.821234] >ffff8881647fdb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.821243] ^ [ 27.821250] ffff8881647fdb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.821259] ffff8881647fdc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.821268] ================================================================== This is caused because the ID extraction happens outside of the range of the edid lenght. This commit addresses this issue by considering the amd_vsdb_block size. (cherry picked from commit b7e381b1ccd5e778e3d9c44c669ad38439a861d8)

Faiblesses (CWE)

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:HLinux
CVSS 3.1HIGH 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HCISA-ADP
CVSS 3.1HIGH 7.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)
CVSS 3.1HIGH 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HNVD · nvd@nist.gov (Primary)
CVSS 3.1HIGH 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HNVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Linux · Linuxaffected ec8e59cb4e0c1a52d5a541fff9dcec398b48f7b4 < 0a326fbc8f72a320051f27328d4d4e7abdfe68d7 ; affected ec8e59cb4e0c1a52d5a541fff9dcec398b48f7b4 < 8db867061f4c76505ad62422b65d666b45289217 ; affected ec8e59cb4e0c1a52d5a541fff9dcec398b48f7b4 < 16dd2825c23530f2259fc671960a3a65d2af69bd
Linux · Linuxaffected 6.6 ; unaffected 0 < 6.6 ; unaffected 6.6.63 ≤ 6.6.* ; unaffected 6.11.10 ≤ 6.11.* ; unaffected 6.12 ≤ *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD