Out-of-Bounds Access Vulnerability in Linux Kernel - CVE-2024-49970
Summary
CVE-2024-49970: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Implement bounds check for stream encoder creation in DCN401 'stream_enc_regs' array is an array of dcn10_stream_enc_registers structur... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its stability, performance, and security features. The kernel supports a wide range of hardware architectures and is widely used in servers, desktops, and embedded systems. This vulnerability specifically affects the AMD display driver within the kernel, which is responsible for managing graphics output and display functionalities.
Vulnerability Detail
CVE-2024-49970 is a vulnerability found in the Linux kernel's AMD display driver, specifically in the function responsible for creating stream encoders. The vulnerability arises from an out-of-bounds access to the 'stream_enc_regs' array, which is intended to hold a limited number of elements (four). An attempt to access this array with an index of 5 leads to undefined behavior, potentially causing system crashes or security breaches. The issue was identified through static analysis tools, highlighting the importance of bounds checking in software development.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected functionality until the patch is applied. This may involve disabling certain graphics features or using alternative display drivers if available.
Conclusion
CVE-2024-49970 is a critical vulnerability in the Linux kernel's AMD display driver that can lead to serious security issues due to out-of-bounds access. Users are advised to update their systems promptly to mitigate risks associated with this vulnerability. Utilizing tools like Vulert can help monitor and identify vulnerabilities in your software effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2024-49970 is a vulnerability in the Linux kernel's AMD display driver that allows for out-of-bounds access to an array, potentially leading to undefined behavior.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
The risks include potential system crashes, data corruption, and exploitation by malicious actors to gain unauthorized access to system resources.
To apply the patch, update your Linux kernel to the latest version using your package manager. For Debian systems, use 'sudo apt-get update && sudo apt-get upgrade linux'.
Yes, you can temporarily disable the affected graphics features or use alternative drivers to mitigate the risk until the patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
