CVE-2024-26660

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Implement bounds check for stream encoder creation in DCN301

'stream_enc_regs' array is an array of dcn10_stream_enc_registers

structures. The array is initialized with four elements, corresponding

to the four calls to stream_enc_regs() in the array initializer. This

means that valid indices for this array are 0, 1, 2, and 3.

The error message 'stream_enc_regs' 4 <= 5 below, is indicating that

there is an attempt to access this array with an index of 5, which is

out of bounds. This could lead to undefined behavior

Here, eng_id is used as an index to access the stream_enc_regs array. If

eng_id is 5, this would result in an out-of-bounds access on the

stream_enc_regs array.

Thus fixing Buffer overflow error in dcn301_stream_encoder_create

reported by Smatch:

drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn301/dcn301_resource.c:1011 dcn301_stream_encoder_create() error: buffer overflow 'stream_e

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References