Out-of-Bounds Access Vulnerability in Linux Kernel Package: linux
Summary
DEBIAN-CVE-2024-27042: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' The issue arises when the array 'adev->vcn.vcn_config' is accessed... Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and security features. The kernel supports a wide range of hardware architectures and is widely used in servers, desktops, and embedded systems. However, like any complex software, it is susceptible to vulnerabilities that can impact system security and stability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the amdgpu driver related to potential out-of-bounds access. This issue occurs when the array 'adev->vcn.vcn_config' is accessed without verifying that the index 'adev->vcn.num_vcn_inst' is within the valid bounds of the array. If this index exceeds the array limits, it could lead to undefined behavior, including crashes or exploitation by malicious actors. The vulnerability was introduced in the amdgpu_discovery_reg_base_init() function, specifically in the file drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c at line 1289.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the package.
Conclusion
The out-of-bounds access vulnerability in the Linux kernel's amdgpu driver poses significant risks to system stability and security. Users are encouraged to update to the patched version 6.7.12-1 to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your systems.
See every vulnerability recorded for linux →
FAQ
The vulnerability is an out-of-bounds access issue in the amdgpu driver of the Linux kernel, which can lead to undefined behavior.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If exploited, this vulnerability could lead to system crashes or allow attackers to execute arbitrary code, compromising system security.
While the primary risk is system instability or exploitation, there is a potential for data loss if the system crashes or is compromised.
It is advisable to regularly check for vulnerabilities, especially after updates or changes to your software dependencies, to ensure ongoing security.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
