Critical Vulnerability in Linux Package: Out-of-Bound Access in AMD Display Driver
Summary
DEBIAN-CVE-2024-46813: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check link_index before accessing dc->links[] [WHY & HOW] dc->links[] has max size of MAX_LINKS and NULL is return when trying to acces... Affects linux versions < 6.10.9-1. Fixed in 6.10.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It includes the Linux kernel, which is responsible for interfacing with the hardware and executing system calls. The kernel is crucial for system stability and security, making it imperative to address any vulnerabilities that may arise.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the AMD display driver related to out-of-bounds access. Specifically, the issue arises when accessing the dc->links[] array without proper bounds checking, which can lead to memory overruns and resource leaks. This vulnerability has been reported through Coverity and can potentially allow an attacker to exploit the system, leading to unauthorized access or system instability.
How To Fix
Minimum fixed version
6.10.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux package.
Conclusion
The identified vulnerability in the Linux package's AMD display driver poses significant risks to system security and stability. Users are strongly encouraged to update to the patched version 6.10.9-1 to mitigate these risks effectively. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability is an out-of-bounds access issue in the AMD display driver within the Linux kernel, which can lead to memory overruns and resource leaks.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Exploiting this vulnerability could lead to unauthorized access, system instability, or crashes, affecting the overall security and performance of the system.
Yes, a patch is available in version 6.10.9-1 of the Linux package. Users should update to this version to mitigate the vulnerability.
While there are no specific workarounds, it is advisable to limit access to the system and monitor for any unusual activity until the update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
