{ "schema_version": "1.6.1", "id": "RPI-CVE-2024-49969", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2024-49969" ], "published": "2024-10-21T18:02:47Z", "summary": "drm/amd/display: Fix index out of bounds in DCN30 color transformation", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix index out of bounds in DCN30 color transformation\n\nThis commit addresses a potential index out of bounds issue in the\n`cm3_helper_translate_curve_to_hw_format` function in the DCN30 color\nmanagement module. The issue could occur when the index 'i' exceeds the\nnumber of transfer function points (TRANSFER_FUNC_POINTS).\n\nThe fix adds a check to ensure 'i' is within bounds before accessing the\ntransfer function points. If 'i' is out of bounds, the function returns\nfalse to indicate an error.\n\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:180 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:181 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:182 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.1.47-1+rpt4" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.1.0-rpi3-rpi-2712", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v6", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v8", "binary_version": "1:6.1.47-1+rpt4" } ] }, "database_specific": { "per_version": { "1:6.1.47-1+rpt4": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.113", "compiled_filter": false } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2024-49969" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/7ab69af56a23859b647dee69fa1052c689343621" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/c13f9c62015c56a938304cef6d507227ea3e0039" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/0f1e222a4b41d77c442901d166fbdca967af0d86" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/929506d5671419cffd8d01e9a7f5eae53682a838" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/578422ddae3d13362b64e77ef9bab98780641631" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/b9d8b94ec7e67f0cae228c054f77b73967c389a3" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/d81873f9e715b72d4f8d391c8eb243946f784dfc" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-05T11:52:36Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - The vulnerable code is only reached through local DRM ioctls (`DRM_IOCTL_MODE_ATOMIC` / legacy gamma set) on `/dev/dri/card*`, driven by amdgpu_dm color-management properties. No remote peer or network data reaches `cm3_helper_translate_curve_to_hw_format`.\nAC:L - Triggering is fully deterministic and entirely attacker-driven: attach a degamma/shaper/blend LUT blob plus a transfer-function enum to a plane or CRTC and commit, and the driver unconditionally walks the loop. There is no race, timing window, or memory-layout precondition outside the attacker's control.\nPR:L - Only an unprivileged local user with DRM master on the card node is required \u2014 the normal state for the logged-in session's compositor or any process on the active VT \u2014 not real root. Setting the AMD plane degamma/shaper/blend TF and LUT properties needs no capability beyond that.\nUI:N - The attacker performs the property set and the atomic commit itself in a single sequence. No victim action, mount, or cooperating process is needed.\nS:U - The faulting access occurs in kernel context on the same host and affects only kernel/GPU-driver resources within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The flagged access is an out-of-bounds read of `output_tf->tf_pts.red/green/blue[]` with an index the compiler and smatch cannot bound (`1025 <= s32max`), so it is not a strictly bounded few-byte read. Kernel memory past the 1025-entry arrays is copied into `rgb_resulted[]` and programmed into the display pipeline's LUT registers.\nI:H - Out-of-range `struct fixed31_32` values sourced from adjacent kernel memory are propagated into `lut_params`/`pwl_params` and written into GPU gamut/gamma hardware registers, corrupting driver and hardware state with data the caller never validated. Consistent with the sibling amd/display index-check fixes (CVE-2024-56784, CVE-2024-56608), this class of unchecked array indexing is treated as memory corruption.\nA:H - An unbounded index into the transfer-function point arrays dereferences memory that may be unmapped, producing a kernel oops inside the atomic-commit path while display-pipeline locks are held, which wedges modesetting and panics the box under `panic_on_oops`." } } }