CVE-2024-26797

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-26797", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.178Z", "datePublished": "2024-04-04T08:20:26.558Z", "dateUpdated": "2026-08-05T11:27:19.496Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:19.496Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Prevent potential buffer overflow in map_hw_resources\n\nAdds a check in the map_hw_resources function to prevent a potential\nbuffer overflow. The function was accessing arrays using an index that\ncould potentially be greater than the size of the arrays, leading to a\nbuffer overflow.\n\nAdds a check to ensure that the index is within the bounds of the\narrays. If the index is out of bounds, an error message is printed and\nbreak it will continue execution with just ignoring extra data early to\nprevent the buffer overflow.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 map_hw_resources() error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id' 6 <= 7\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 map_hw_resources() error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id' 6 <= 7"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached only through DRM KMS ioctls (`DRM_IOCTL_MODE_ATOMIC`/`SETCRTC`) on `/dev/dri/cardN` via `amdgpu_dm_atomic_check()` \u2192 `dc_validate_global_state()` \u2192 `dml2_validate()`. No network or remote data path reaches `map_hw_resources()`.\nAC:L - The attacker controls the display configuration submitted in the atomic commit (number of streams, planes, and modes that force ODM combine 2:1/4:1, driving `DPPPerSurface` and hence `num_pipes`), so the out-of-bounds indices are reached deterministically without depending on any condition outside the attacker's control.\nPR:L - Only an unprivileged local account with access to the DRM device node is needed \u2014 the code path contains no capability check, and any logged-in seat user (or a compositor/kiosk process) can issue the atomic modeset that reaches `map_hw_resources()`.\nUI:N - The attacker performs the modeset himself via ioctl in a loop; no action by another user or victim is required to trigger the overflow.\nS:U - The corruption is confined to kernel heap memory in the same security authority as the exploiting process; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The loop performs out-of-bounds reads of `disp_cfg_to_stream_id[6..7]` and `disp_cfg_to_plane_id[6..7]`, and the resulting leaked heap contents are copied into the DML-to-DC pipe mapping that drives subsequent pipe lookups, so out-of-bounds kernel data becomes observable and usable \u2014 per kernel guidance, an unbounded OOB read plus heap corruption is High.\nI:H - `dml_pipe_idx_to_stream_id[num_pipes]` and friends are written with unbounded `num_pipes`, placing attacker-influenced 32-bit IDs and `true` bytes past the 6-element arrays and past the end of `struct dml2_dml_to_dc_pipe_mapping` into the surrounding `struct dml2_context` heap allocation \u2014 an out-of-bounds write with partially controlled data, which is High.\nA:H - The out-of-bounds writes corrupt DML scratch state and pipe-mapping data that is subsequently used to index `res_ctx.pipe_ctx[]` and program display hardware, readily producing an oops, display-engine hang, or panic (and detectable as a KASAN slab-out-of-bounds), which is a full availability loss."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c"], "versions": [{"version": "7966f319c66d9468623c6a6a017ecbc0dd79be75", "lessThan": "50a6302cf881f67f1410461a68fe9eabd00ff31d", "status": "affected", "versionType": "git"}, {"version": "7966f319c66d9468623c6a6a017ecbc0dd79be75", "lessThan": "0f8ca019544a252d1afb468ce840c6dcbac73af4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.9", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.7.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/50a6302cf881f67f1410461a68fe9eabd00ff31d"}, {"url": "https://git.kernel.org/stable/c/0f8ca019544a252d1afb468ce840c6dcbac73af4"}], "title": "drm/amd/display: Prevent potential buffer overflow in map_hw_resources", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-120", "lang": "en", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "affected": [{"vendor": "linux", "product": "linux_kernel", "cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "7966f319c66d", "status": "affected", "lessThan": "50a6302cf881", "versionType": "custom"}, {"version": "7966f319c66d", "status": "affected", "lessThan": "0f8ca019544a", "versionType": "custom"}, {"version": "6.7", "status": "affected"}, {"version": "0", "status": "unaffected", "lessThan": "6.7", "versionType": "custom"}, {"version": "6.79", "status": "unaffected", "lessThanOrEqual": "6.8", "versionType": "custom"}, {"version": "6.8", "status": "unaffected", "lessThanOrEqual": "*", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-04-04T16:00:44.653604Z", "id": "CVE-2024-26797", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-16T14:02:40.989Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.520Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/50a6302cf881f67f1410461a68fe9eabd00ff31d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0f8ca019544a252d1afb468ce840c6dcbac73af4", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/50a6302cf881f67f1410461a68fe9eabd00ff31d", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0f8ca019544a252d1afb468ce840c6dcbac73af4", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.520Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-26797", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-04T16:00:44.653604Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "vendor": "linux", "product": "linux_kernel", "versions": [{"status": "affected", "version": "7966f319c66d", "lessThan": "50a6302cf881", "versionType": "custom"}, {"status": "affected", "version": "7966f319c66d", "lessThan": "0f8ca019544a", "versionType": "custom"}, {"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "custom"}, {"status": "unaffected", "version": "6.79", "versionType": "custom", "lessThanOrEqual": "6.8"}, {"status": "unaffected", "version": "6.8", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-16T13:56:37.589Z"}}], "cna": {"title": "drm/amd/display: Prevent potential buffer overflow in map_hw_resources", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached only through DRM KMS ioctls (`DRM_IOCTL_MODE_ATOMIC`/`SETCRTC`) on `/dev/dri/cardN` via `amdgpu_dm_atomic_check()` \u2192 `dc_validate_global_state()` \u2192 `dml2_validate()`. No network or remote data path reaches `map_hw_resources()`.\nAC:L - The attacker controls the display configuration submitted in the atomic commit (number of streams, planes, and modes that force ODM combine 2:1/4:1, driving `DPPPerSurface` and hence `num_pipes`), so the out-of-bounds indices are reached deterministically without depending on any condition outside the attacker's control.\nPR:L - Only an unprivileged local account with access to the DRM device node is needed \u2014 the code path contains no capability check, and any logged-in seat user (or a compositor/kiosk process) can issue the atomic modeset that reaches `map_hw_resources()`.\nUI:N - The attacker performs the modeset himself via ioctl in a loop; no action by another user or victim is required to trigger the overflow.\nS:U - The corruption is confined to kernel heap memory in the same security authority as the exploiting process; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The loop performs out-of-bounds reads of `disp_cfg_to_stream_id[6..7]` and `disp_cfg_to_plane_id[6..7]`, and the resulting leaked heap contents are copied into the DML-to-DC pipe mapping that drives subsequent pipe lookups, so out-of-bounds kernel data becomes observable and usable \u2014 per kernel guidance, an unbounded OOB read plus heap corruption is High.\nI:H - `dml_pipe_idx_to_stream_id[num_pipes]` and friends are written with unbounded `num_pipes`, placing attacker-influenced 32-bit IDs and `true` bytes past the 6-element arrays and past the end of `struct dml2_dml_to_dc_pipe_mapping` into the surrounding `struct dml2_context` heap allocation \u2014 an out-of-bounds write with partially controlled data, which is High.\nA:H - The out-of-bounds writes corrupt DML scratch state and pipe-mapping data that is subsequently used to index `res_ctx.pipe_ctx[]` and program display hardware, readily producing an oops, display-engine hang, or panic (and detectable as a KASAN slab-out-of-bounds), which is a full availability loss."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7966f319c66d9468623c6a6a017ecbc0dd79be75", "lessThan": "50a6302cf881f67f1410461a68fe9eabd00ff31d", "versionType": "git"}, {"status": "affected", "version": "7966f319c66d9468623c6a6a017ecbc0dd79be75", "lessThan": "0f8ca019544a252d1afb468ce840c6dcbac73af4", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.7.9", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/50a6302cf881f67f1410461a68fe9eabd00ff31d"}, {"url": "https://git.kernel.org/stable/c/0f8ca019544a252d1afb468ce840c6dcbac73af4"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Prevent potential buffer overflow in map_hw_resources\n\nAdds a check in the map_hw_resources function to prevent a potential\nbuffer overflow. The function was accessing arrays using an index that\ncould potentially be greater than the size of the arrays, leading to a\nbuffer overflow.\n\nAdds a check to ensure that the index is within the bounds of the\narrays. If the index is out of bounds, an error message is printed and\nbreak it will continue execution with just ignoring extra data early to\nprevent the buffer overflow.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 map_hw_resources() error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id' 6 <= 7\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 map_hw_resources() error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id' 6 <= 7"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.9", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "6.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:19.496Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26797", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:27:19.496Z", "dateReserved": "2024-02-19T14:20:24.178Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-04T08:20:26.558Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "50a6302cf881f67f1410461a68fe9eabd00ff31d", "status": "affected", "version": "7966f319c66d9468623c6a6a017ecbc0dd79be75", "versionType": "git"}, {"lessThan": "0f8ca019544a252d1afb468ce840c6dcbac73af4", "status": "affected", "version": "7966f319c66d9468623c6a6a017ecbc0dd79be75", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"cpes": ["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "linux_kernel", "vendor": "linux", "versions": [{"lessThan": "50a6302cf881", "status": "affected", "version": "7966f319c66d", "versionType": "custom"}, {"lessThan": "0f8ca019544a", "status": "affected", "version": "7966f319c66d", "versionType": "custom"}, {"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "custom"}, {"lessThanOrEqual": "6.8", "status": "unaffected", "version": "6.79", "versionType": "custom"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1C538467-EDA0-4A9A-82EB-2925DE9FF827", "versionEndExcluding": "6.7.9", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*", "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*", "matchCriteriaId": "F02056A5-B362-4370-9FF8-6F0BD384D520", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*", "matchCriteriaId": "62075ACE-B2A0-4B16-829D-B3DA5AE5CC41", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*", "matchCriteriaId": "A780F817-2A77-4130-A9B7-5C25606314E3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*", "matchCriteriaId": "AEB9199B-AB8F-4877-8964-E2BA95B5F15C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Prevent potential buffer overflow in map_hw_resources\n\nAdds a check in the map_hw_resources function to prevent a potential\nbuffer overflow. The function was accessing arrays using an index that\ncould potentially be greater than the size of the arrays, leading to a\nbuffer overflow.\n\nAdds a check to ensure that the index is within the bounds of the\narrays. If the index is out of bounds, an error message is printed and\nbreak it will continue execution with just ignoring extra data early to\nprevent the buffer overflow.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 map_hw_resources() error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id' 6 <= 7\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 map_hw_resources() error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id' 6 <= 7"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/display: Previene un posible desbordamiento del b\u00fafer en map_hw_resources Agrega una verificaci\u00f3n en la funci\u00f3n map_hw_resources para evitar un posible desbordamiento del b\u00fafer. La funci\u00f3n acced\u00eda a matrices utilizando un \u00edndice que potencialmente podr\u00eda ser mayor que el tama\u00f1o de las matrices, lo que provocaba un desbordamiento del b\u00fafer. Agrega una verificaci\u00f3n para garantizar que el \u00edndice est\u00e9 dentro de los l\u00edmites de las matrices. Si el \u00edndice est\u00e1 fuera de los l\u00edmites, se imprime un mensaje de error y, al interrumpirlo, continuar\u00e1 la ejecuci\u00f3n ignorando los datos adicionales antes de tiempo para evitar el desbordamiento del b\u00fafer. Reportado por smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 error map_hw_resources(): desbordamiento del b\u00fafer 'dml2-&gt;v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id' 6 &lt;= 7 controladores/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 error map_hw_resources(): desbordamiento del b\u00fafer 'dml2-&gt;v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id' 6 &lt;= 7"}], "id": "CVE-2024-26797", "lastModified": "2026-06-17T07:18:22.283", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26797", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-04-04T16:00:44.653604Z", "version": "2.0.3"}}]}, "published": "2024-04-04T09:15:08.843", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0f8ca019544a252d1afb468ce840c6dcbac73af4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/50a6302cf881f67f1410461a68fe9eabd00ff31d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0f8ca019544a252d1afb468ce840c6dcbac73af4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/50a6302cf881f67f1410461a68fe9eabd00ff31d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: drm/amd/display: Prevent potential buffer overflow in map_hw_resources", "id": "2273436", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2273436"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-120", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amd/display: Prevent potential buffer overflow in map_hw_resources\nAdds a check in the map_hw_resources function to prevent a potential\nbuffer overflow. The function was accessing arrays using an index that\ncould potentially be greater than the size of the arrays, leading to a\nbuffer overflow.\nAdds a check to ensure that the index is within the bounds of the\narrays. If the index is out of bounds, an error message is printed and\nbreak it will continue execution with just ignoring extra data early to\nprevent the buffer overflow.\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 map_hw_resources() error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id' 6 <= 7\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 map_hw_resources() error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id' 6 <= 7", "A vulnerability was found in the Linux kernel\u2019s AMD display driver, affecting the `map_hw_resources` function. This issue could lead to a buffer overflow, which may cause system crashes or allow arbitrary code execution."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-26797", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26797\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26797\nhttps://lore.kernel.org/linux-cve-announce/2024040402-CVE-2024-26797-704f@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate"}

{}