Log in Start free

Vulnerability · Published Jun 19, 2024 · Assigned by Linux

CVE-2024-38552drm/amd/display: Fix potential index out of bounds in color transformation function

High 7.3

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 77.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential index out of bounds in color transformation function Fixes index out of bounds issue in the color transformation function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS). The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds, an error message is logged and the function returns false to indicate an error. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.94-1DEBIAN-CVE-2024-38552
Debian:13linux6.8.12-1DEBIAN-CVE-2024-38552
Debian:14linux6.8.12-1DEBIAN-CVE-2024-38552
Ubuntu:22.04:LTSlinux5.15.0-121.131UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux5.15.0-121.131USN-7007-1
Ubuntu:24.04:LTSlinux6.8.0-40.40UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-aws5.15.0-1069.75UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-aws5.15.0-1069.75USN-7007-1
Ubuntu:24.04:LTSlinux-aws6.8.0-1013.14UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1013.14~22.04.1UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-azure5.15.0-1072.81USN-7009-1
Ubuntu:22.04:LTSlinux-azure5.15.0-1072.81UBUNTU-CVE-2024-38552
Ubuntu:24.04:LTSlinux-azure6.8.0-1012.14UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1012.14~22.04.1UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1072.81.1USN-7009-1
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1072.81.1UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-gcp5.15.0-1068.76USN-7007-1
Ubuntu:22.04:LTSlinux-gcp5.15.0-1068.76UBUNTU-CVE-2024-38552
Ubuntu:24.04:LTSlinux-gcp6.8.0-1012.13UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1012.13~22.04.1UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-gke5.15.0-1066.72UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-gke5.15.0-1066.72USN-7007-1
Ubuntu:24.04:LTSlinux-gke6.8.0-1008.11UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1052.59USN-7007-1
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1052.59UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-40.40~22.04.3UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-ibm5.15.0-1062.65UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-ibm5.15.0-1062.65USN-7007-1
Ubuntu:24.04:LTSlinux-ibm6.8.0-1010.10UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1010.10~22.04.1UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1064.70USN-7007-1
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1064.70UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-kvm5.15.0-1066.71UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-kvm5.15.0-1066.71USN-7007-1
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-121.131USN-7007-3
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-121.131UBUNTU-CVE-2024-38552
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-40.40.1UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-40.40.1~22.04.1UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1064.65USN-7007-1
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1064.65UBUNTU-CVE-2024-38552
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1011.11UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1011.11~22.04.1UBUNTU-CVE-2024-38552
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1011.11.1UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1028.28UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1016.16UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-38552
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1010.10UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-oracle5.15.0-1067.73USN-7007-1
Ubuntu:22.04:LTSlinux-oracle5.15.0-1067.73UBUNTU-CVE-2024-38552
Ubuntu:24.04:LTSlinux-oracle6.8.0-1010.10UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1010.10~22.04.1UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-raspi5.15.0-1062.65UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-raspi5.15.0-1062.65USN-7007-1
Ubuntu:24.04:LTSlinux-raspi6.8.0-1009.10UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-38552
Ubuntu:24.04:LTSlinux-riscv6.8.0-40.40.1UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-40.40.1~22.04.1UBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-38552
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1035.39UBUNTU-CVE-2024-38552

Affected products (as reported)

VendorProductVersions
Linux Linux b629596072e5fa901c84f9e88d845a696ee32942 – before 604c506ca43fce52bb882cff9c1fdf2ec3b4029cb629596072e5fa901c84f9e88d845a696ee32942 – before e280ab978c81443103d7c61bdd1d8d708cf6ed6db629596072e5fa901c84f9e88d845a696ee32942 – before 04bc4d1090c343025d69149ca669a27c5b9c34a7b629596072e5fa901c84f9e88d845a696ee32942 – before ced9c4e2289a786b8fa684d8893b7045ea53ef7eb629596072e5fa901c84f9e88d845a696ee32942 – before 98b8a6bfd30d07a19cfacdf82b50f84bf3360869b629596072e5fa901c84f9e88d845a696ee32942 – before 4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86b629596072e5fa901c84f9e88d845a696ee32942 – before 123edbae64f4d21984359b99c6e79fcde31c6123b629596072e5fa901c84f9e88d845a696ee32942 – before 7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29
Linux Linux 4.16

References