Off-by-One Vulnerability in drm/amd/display Package
Summary
GSD-2021-1000376: drm/amd/display: Fix off by one in hdmi_14_process_transaction(). Affects Kernel versions >= 4c283fdac08abf3211533f70623c90a34f41d08d, < 403c4528e5887af3deb9838cb77a557631d1e138. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/amd/display package is a component of the Linux Kernel that handles display functionality for AMD graphics cards. It provides the necessary drivers and interfaces for managing display outputs, including HDMI connections. This vulnerability specifically affects the hdmi_14_process_transaction() function within the package.
Vulnerability Detail
The hdmi_14_process_transaction() function in the drm/amd/display package suffers from an off-by-one error. This vulnerability was introduced in version v5.5 of the Linux Kernel and fixed in version v5.10.37. An attacker could potentially exploit this vulnerability to cause a buffer overflow or other memory corruption issues, leading to a denial of service or potential remote code execution.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.37 or later. This can be done by pulling the latest updates from the official Linux Kernel repository and rebuilding the kernel. Alternatively, users can wait for their Linux distribution to release an updated package that includes the fix.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Linux Kernel to the fixed version as soon as possible.
Conclusion
The off-by-one vulnerability in the drm/amd/display package can potentially lead to memory corruption or remote code execution. It is crucial to update the Linux Kernel to version v5.10.37 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial of service by exploiting the off-by-one error in the hdmi_14_process_transaction() function.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any known vulnerabilities.
Yes, this vulnerability can be exploited remotely if an attacker can send malicious HDMI transactions to the affected system.
There are no known reports of this vulnerability being exploited in the wild at this time.
For more technical details and information about this vulnerability, you can refer to the official Linux Kernel repository and the associated commit history.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.