{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-46811","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-09-11T15:12:18.283Z","datePublished":"2024-09-27T12:35:54.445Z","dateUpdated":"2026-08-05T11:38:42.789Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:38:42.789Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box\n\n[Why]\nCoverity reports OVERRUN warning. soc.num_states could\nbe 40. But array range of bw_params->clk_table.entries is 8.\n\n[How]\nAssert if soc.num_states greater than 8."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","baseScore":7.3,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only through amdgpu DC initialization paths on the local machine — `dc_construct()`, `dcn32_init_hw()`, and `get_memclk_states_from_smu()` during hardware init and suspend/resume. There is no network, adjacent-network, or physical-device vector.\nAC:L - On affected hardware the overrun happens deterministically whenever the firmware-reported DPM level count plus the hardcoded DCFCLK STA targets exceeds 8 — no race to win, no memory layout to groom, and no unlikely precondition. The vulnerable path in dcn302/dcn303 is entirely ungated.\nPR:L - The trigger points (DC hardware init and resume of the DRM device) are reachable in an ordinary unprivileged desktop session via logind-mediated suspend/resume of the GPU, without root in the init namespace. No pre-authentication or remote path exists, so PR:N is not supportable.\nUI:N - The bounding-box update runs automatically during driver hardware init and resume; no victim action such as opening a file or plugging in a display is required.\nS:U - The out-of-bounds read and the resulting corrupted DML bounding box are both entirely within the kernel's own security authority — there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - With `num_states` able to reach `DC__VOLTAGE_STATES` (40) against an 8-element `entries[]`, the read runs up to ~1.3 KB past the end of the `struct clk_bw_params` allocation into adjacent slab memory — far beyond a \"few bytes\" bounded read. Those bytes are copied into `dml.soc.clock_limits[]`, which feeds userspace-observable clock and mode-validation state.\nI:L - There is no out-of-bounds write — `clock_limits[]` is 40 entries and the index is bounded by that — but attacker-uncontrolled garbage from adjacent memory is written into the DML soc bounding box and then used to program dispclk/dppclk/dcfclk/socclk, corrupting kernel state that drives real display hardware.\nA:H - Reading past the end of the heap-allocated `clk_bw_params` can fault or oops and reliably trips KASAN, and feeding nonsensical clock/voltage limits into DML can hang or blank the display pipeline. Any such kernel crash or hang is High."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c","drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c","drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c","drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c"],"versions":[{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","lessThan":"4003bac784380fed1f94f197350567eaa73a409d","status":"affected","versionType":"git"},{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","lessThan":"aba188d6f4ebaf52acf13f204db2bd2c22072504","status":"affected","versionType":"git"},{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","lessThan":"188fd1616ec43033cedbe343b6579e9921e2d898","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c","drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c","drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c","drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c"],"versions":[{"version":"4.15","status":"affected"},{"version":"0","lessThan":"4.15","status":"unaffected","versionType":"semver"},{"version":"6.6.50","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.10.9","lessThanOrEqual":"6.10.*","status":"unaffected","versionType":"semver"},{"version":"6.11","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.6.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.10.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.11"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/4003bac784380fed1f94f197350567eaa73a409d"},{"url":"https://git.kernel.org/stable/c/aba188d6f4ebaf52acf13f204db2bd2c22072504"},{"url":"https://git.kernel.org/stable/c/188fd1616ec43033cedbe343b6579e9921e2d898"}],"title":"drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-29T14:19:04.715171Z","id":"CVE-2024-46811","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-29T14:19:16.904Z"}}]}}