CVE-2024-50221

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pm: Vangogh: Fix kernel memory out of bounds write

KASAN reports that the GPU metrics table allocated in

vangogh_tables_init() is not large enough for the memset done in

smu_cmn_init_soft_gpu_metrics(). Condensed report follows:

[ 33.861314] BUG: KASAN: slab-out-of-bounds in smu_cmn_init_soft_gpu_metrics+0x73/0x200 [amdgpu]

[ 33.861799] Write of size 168 at addr ffff888129f59500 by task mangoapp/1067

...

[ 33.861808] CPU: 6 UID: 1000 PID: 1067 Comm: mangoapp Tainted: G W 6.12.0-rc4 #356 1a56f59a8b5182eeaf67eb7cb8b13594dd23b544

[ 33.861816] Tainted: [W]=WARN

[ 33.861818] Hardware name: Valve Galileo/Galileo, BIOS F7G0107 12/01/2023

[ 33.861822] Call Trace:

[ 33.861826] <TASK>

[ 33.861829] dump_stack_lvl+0x66/0x90

[ 33.861838] print_report+0xce/0x620

[ 33.861853] kasan_report+0xda/0x110

[ 33.862794] kasan_check_range+0xfd/0x1a0

[ 33.862799] __asan_memset+0x23/0x40

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References