Buffer Overflow Vulnerability in Linux Kernel Package: linux (Debian 13 & 14)
Summary
DEBIAN-CVE-2024-49970: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Implement bounds check for stream encoder creation in DCN401 'stream_enc_regs' array is an array of dcn10_stream_enc_registers structur... Affects linux versions < 6.11.4-1. Fixed in 6.11.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is the core of the Debian operating system, providing essential functionalities for hardware interaction, process management, and system resource allocation. It is a critical component that ensures the stability and performance of the system. This vulnerability affects the display driver component of the Linux kernel, specifically in the AMD graphics driver, which is responsible for rendering graphics on systems using AMD hardware.
Vulnerability Detail
In the Linux kernel, a buffer overflow vulnerability has been identified in the AMD display driver (dcn401). The issue arises from an out-of-bounds access to the 'stream_enc_regs' array, which is intended to hold a limited number of elements (0 to 3). An attempt to access this array with an index of 5 can lead to undefined behavior, potentially allowing an attacker to exploit this flaw and execute arbitrary code or crash the system. This vulnerability was discovered in the function dcn401_stream_encoder_create, where the eng_id variable is improperly used as an index.
How To Fix
Minimum fixed version
6.11.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package as described above.
Conclusion
The buffer overflow vulnerability in the Linux kernel's AMD display driver poses significant risks to systems running Debian 13 and 14. It is crucial for users to update their linux package to the patched version 6.11.4-1 to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
A buffer overflow vulnerability occurs when a program writes more data to a buffer than it can hold, leading to memory corruption and potential exploitation.
Exploitation of this vulnerability could allow an attacker to execute arbitrary code, leading to system crashes or unauthorized access to sensitive information.
If you are using Debian 13 or 14 with the linux package version prior to 6.11.4-1, your system is vulnerable. You can check for vulnerabilities using Vulert.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software by analyzing a manifest file like package-lock.json, without requiring code access or installation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
