Описание
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 [Why] Coverity reports OVERRUN warning. Should abort amdgpu_dm initialize. [How] Return failure to amdgpu_dm_init.
Отчет
A flaw was found in the Linux kernel AMD display manager (amdgpu_dm) driver, in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c. During amdgpu_dm initialization, the driver does not abort when the number of display streams exceeds the maximum of six streams supported by its internal arrays, which can result in an out-of-bounds array access (reported by Coverity as an OVERRUN warning). Red Hat rates this flaw as Low impact because triggering the issue requires local access with high privileges and impacts availability only (RH CVSS 4.4, AV:L/AC:L/PR:H, C:N/I:N/A:H). All Red Hat Enterprise Linux kernel and kernel-rt streams are currently listed as not affected by this flaw; only the Fedora community kernel is affected, and a fix is being pursued through the community kernel process (delegated resolution). The upstream CVE record severity (CVEORG CVSS 7.4, Important) is higher than Red Hat's assessment (4.4, Moderate) due to differences in the scored privileges required and impact dimensions (CVEORG scores PR:N with C:H/I:H/A:H, while Red Hat scores PR:H with availability-only impact).
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
4.4 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 [Why] Coverity reports OVERRUN warning. Should abort amdgpu_dm initialize. [How] Return failure to amdgpu_dm_init.
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 [Why] Coverity reports OVERRUN warning. Should abort amdgpu_dm initialize. [How] Return failure to amdgpu_dm_init.
In the Linux kernel, the following vulnerability has been resolved: d ...
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 [Why] Coverity reports OVERRUN warning. Should abort amdgpu_dm initialize. [How] Return failure to amdgpu_dm_init.
Уязвимость компонентов drm/amd/display ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
4.4 Medium
CVSS3