{"dataType":"CVE_RECORD","cveMetadata":{"cveId":"CVE-2024-38552","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-06-18T19:36:34.920Z","datePublished":"2024-06-19T13:35:24.067Z","dateUpdated":"2026-08-05T11:32:43.970Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:32:43.970Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix potential index out of bounds in color transformation function\n\nFixes index out of bounds issue in the color transformation function.\nThe issue could occur when the index 'i' exceeds the number of transfer\nfunction points (TRANSFER_FUNC_POINTS).\n\nThe fix adds a check to ensure 'i' is within bounds before accessing the\ntransfer function points. If 'i' is out of bounds, an error message is\nlogged and the function returns false to indicate an error.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","baseScore":7.3,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The code is reached only through the DRM atomic modeset ioctl on /dev/dri/cardN (amdgpu_dm color management → dcn*_set_output_transfer_func); there is no network or remote-peer path into the AMD display color pipeline.\nAC:L - The attacker directly supplies the GAMMA_LUT/DEGAMMA_LUT blobs and the shaper/blend transfer-function enums that drive the loop, and can re-issue the atomic commit at will with no race and no dependence on unpredictable system state.\nPR:L - DRM_IOCTL_MODE_ATOMIC is gated on DRM_MASTER (drm_ioctl.c:701), which the logged-in seat user or a member of the video group holds on the active VT — no root or CAP_SYS_ADMIN is required.\nUI:N - The attacker performs the atomic commit itself; no victim action, no filesystem mount, and no separate user interaction is needed.\nS:U - The out-of-bounds access stays within the kernel's own memory and the amdgpu driver's security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The flagged defect is an unbounded out-of-bounds read past the 1025-entry tf_pts arrays inside the kernel heap object, not a read strictly bounded to a few bytes, so adjacent kernel heap contents can be sampled and pushed into the display pipeline.\nI:L - The out-of-bounds values are converted and programmed into the DPP regamma/shaper hardware LUT, corrupting display output with attacker-uncontrolled kernel data; there is no out-of-bounds write and no control-flow hijack primitive, so impact is limited.\nA:H - An out-of-bounds read at a large index can touch an unmapped page or trip KASAN/hardened-usercopy checks, oopsing in the atomic commit path while display locks are held, and an unprivileged seat user can retrigger it in a loop."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c"],"versions":[{"version":"b629596072e5fa901c84f9e88d845a696ee32942","lessThan":"604c506ca43fce52bb882cff9c1fdf2ec3b4029c","status":"affected","versionType":"git"},{"version":"b629596072e5fa901c84f9e88d845a696ee32942","lessThan":"e280ab978c81443103d7c61bdd1d8d708cf6ed6d","status":"affected","versionType":"git"},{"version":"b629596072e5fa901c84f9e88d845a696ee32942","lessThan":"04bc4d1090c343025d69149ca669a27c5b9c34a7","status":"affected","versionType":"git"},{"version":"b629596072e5fa901c84f9e88d845a696ee32942","lessThan":"ced9c4e2289a786b8fa684d8893b7045ea53ef7e","status":"affected","versionType":"git"},{"version":"b629596072e5fa901c84f9e88d845a696ee32942","lessThan":"98b8a6bfd30d07a19cfacdf82b50f84bf3360869","status":"affected","versionType":"git"},{"version":"b629596072e5fa901c84f9e88d845a696ee32942","lessThan":"4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86","status":"affected","versionType":"git"},{"version":"b629596072e5fa901c84f9e88d845a696ee32942","lessThan":"123edbae64f4d21984359b99c6e79fcde31c6123","status":"affected","versionType":"git"},{"version":"b629596072e5fa901c84f9e88d845a696ee32942","lessThan":"7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29","status":"affected","versionType":"git"},{"version":"b629596072e5fa901c84f9e88d845a696ee32942","lessThan":"63ae548f1054a0b71678d0349c7dc9628ddd42ca","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c"],"versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","status":"unaffected","versionType":"semver"},{"version":"4.19.316","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.278","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.219","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.161","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.93","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.33","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.8.12","lessThanOrEqual":"6.8.*","status":"unaffected","versionType":"semver"},{"version":"6.9.3","lessThanOrEqual":"6.9.*","status":"unaffected","versionType":"semver"},{"version":"6.10","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"4.19.316"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"5.4.278"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"5.10.219"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"5.15.161"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"6.1.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"6.6.33"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"6.8.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"6.9.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.16","versionEndExcluding":"6.10"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/604c506ca43fce52bb882cff9c1fdf2ec3b4029c"},{"url":"https://git.kernel.org/stable/c/e280ab978c81443103d7c61bdd1d8d708cf6ed6d"},{"url":"https://git.kernel.org/stable/c/04bc4d1090c343025d69149ca669a27c5b9c34a7"},{"url":"https://git.kernel.org/stable/c/ced9c4e2289a786b8fa684d8893b7045ea53ef7e"},{"url":"https://git.kernel.org/stable/c/98b8a6bfd30d07a19cfacdf82b50f84bf3360869"},{"url":"https://git.kernel.org/stable/c/4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86"},{"url":"https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123"},{"url":"https://git.kernel.org/stable/c/7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29"},{"url":"https://git.kernel.org/stable/c/63ae548f1054a0b71678d0349c7dc9628ddd42ca"}],"title":"drm/amd/display: Fix potential index out of bounds in color transformation function","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/604c506ca43fce52bb882cff9c1fdf2ec3b4029c","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/e280ab978c81443103d7c61bdd1d8d708cf6ed6d","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/04bc4d1090c343025d69149ca669a27c5b9c34a7","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/ced9c4e2289a786b8fa684d8893b7045ea53ef7e","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/98b8a6bfd30d07a19cfacdf82b50f84bf3360869","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/63ae548f1054a0b71678d0349c7dc9628ddd42ca","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-04T17:21:24.332Z"}},{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-38552","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T17:14:50.788974Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-11T17:34:57.332Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-05-12T11:54:36.137Z"},"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","versions":[{"status":"affected","version":"0","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}]}]},"dataVersion":"5.2"}