{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-26797","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-19T14:20:24.178Z","datePublished":"2024-04-04T08:20:26.558Z","dateUpdated":"2026-08-05T11:27:19.496Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:27:19.496Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Prevent potential buffer overflow in map_hw_resources\n\nAdds a check in the map_hw_resources function to prevent a potential\nbuffer overflow. The function was accessing arrays using an index that\ncould potentially be greater than the size of the arrays, leading to a\nbuffer overflow.\n\nAdds a check to ensure that the index is within the bounds of the\narrays. If the index is out of bounds, an error message is printed and\nbreak it will continue execution with just ignoring extra data early to\nprevent the buffer overflow.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 map_hw_resources() error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id' 6 <= 7\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:81 map_hw_resources() error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id' 6 <= 7"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only through DRM KMS ioctls (`DRM_IOCTL_MODE_ATOMIC`/`SETCRTC`) on `/dev/dri/cardN` via `amdgpu_dm_atomic_check()` → `dc_validate_global_state()` → `dml2_validate()`. No network or remote data path reaches `map_hw_resources()`.\nAC:L - The attacker controls the display configuration submitted in the atomic commit (number of streams, planes, and modes that force ODM combine 2:1/4:1, driving `DPPPerSurface` and hence `num_pipes`), so the out-of-bounds indices are reached deterministically without depending on any condition outside the attacker's control.\nPR:L - Only an unprivileged local account with access to the DRM device node is needed — the code path contains no capability check, and any logged-in seat user (or a compositor/kiosk process) can issue the atomic modeset that reaches `map_hw_resources()`.\nUI:N - The attacker performs the modeset himself via ioctl in a loop; no action by another user or victim is required to trigger the overflow.\nS:U - The corruption is confined to kernel heap memory in the same security authority as the exploiting process; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The loop performs out-of-bounds reads of `disp_cfg_to_stream_id[6..7]` and `disp_cfg_to_plane_id[6..7]`, and the resulting leaked heap contents are copied into the DML-to-DC pipe mapping that drives subsequent pipe lookups, so out-of-bounds kernel data becomes observable and usable — per kernel guidance, an unbounded OOB read plus heap corruption is High.\nI:H - `dml_pipe_idx_to_stream_id[num_pipes]` and friends are written with unbounded `num_pipes`, placing attacker-influenced 32-bit IDs and `true` bytes past the 6-element arrays and past the end of `struct dml2_dml_to_dc_pipe_mapping` into the surrounding `struct dml2_context` heap allocation — an out-of-bounds write with partially controlled data, which is High.\nA:H - The out-of-bounds writes corrupt DML scratch state and pipe-mapping data that is subsequently used to index `res_ctx.pipe_ctx[]` and program display hardware, readily producing an oops, display-engine hang, or panic (and detectable as a KASAN slab-out-of-bounds), which is a full availability loss."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c"],"versions":[{"version":"7966f319c66d9468623c6a6a017ecbc0dd79be75","lessThan":"50a6302cf881f67f1410461a68fe9eabd00ff31d","status":"affected","versionType":"git"},{"version":"7966f319c66d9468623c6a6a017ecbc0dd79be75","lessThan":"0f8ca019544a252d1afb468ce840c6dcbac73af4","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/display/dc/dml2/dml2_wrapper.c"],"versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","status":"unaffected","versionType":"semver"},{"version":"6.7.9","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.7.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/50a6302cf881f67f1410461a68fe9eabd00ff31d"},{"url":"https://git.kernel.org/stable/c/0f8ca019544a252d1afb468ce840c6dcbac73af4"}],"title":"drm/amd/display: Prevent potential buffer overflow in map_hw_resources","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-120","lang":"en","description":"CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}],"affected":[{"vendor":"linux","product":"linux_kernel","cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","versions":[{"version":"7966f319c66d","status":"affected","lessThan":"50a6302cf881","versionType":"custom"},{"version":"7966f319c66d","status":"affected","lessThan":"0f8ca019544a","versionType":"custom"},{"version":"6.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.7","versionType":"custom"},{"version":"6.79","status":"unaffected","lessThanOrEqual":"6.8","versionType":"custom"},{"version":"6.8","status":"unaffected","lessThanOrEqual":"*","versionType":"custom"}]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-04-04T16:00:44.653604Z","id":"CVE-2024-26797","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-07-16T14:02:40.989Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T00:14:13.520Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/50a6302cf881f67f1410461a68fe9eabd00ff31d","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/0f8ca019544a252d1afb468ce840c6dcbac73af4","tags":["x_transferred"]}]}]}}