Avoid HDCP over-read and corruption in drm/amd/display
Summary
GSD-2021-1001223: drm/amd/display: Avoid HDCP over-read and corruption. Affects Kernel versions < 3b2b93a485fb7a970bc8b5daef16f4cf579d172f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/amd/display package is a component of the Linux Kernel that handles display functionality for AMD graphics cards. It provides the necessary drivers and interfaces for managing graphics output, including features like HDCP (High-bandwidth Digital Content Protection). HDCP is a security mechanism used to protect copyrighted content from unauthorized access or copying. However, a vulnerability has been discovered in the drm/amd/display package that can lead to HDCP over-read and corruption.
Vulnerability Detail
The vulnerability in the drm/amd/display package allows for HDCP over-read and corruption. HDCP over-read occurs when the package reads more data than necessary from HDCP-protected content, potentially exposing sensitive information. HDCP corruption refers to the manipulation or alteration of HDCP-protected content, which can lead to unauthorized access or tampering. This vulnerability could be exploited by an attacker to bypass HDCP protection and gain access to copyrighted content or manipulate it in unintended ways.
How To Fix
No fixed version is published for this vulnerability.
The vulnerability has been fixed in Linux Kernel version v5.13.3 by commit 3b2b93a485fb7a970bc8b5daef16f4cf579d172f. To fix the vulnerability, users should update their Linux Kernel to version v5.13.3 or later. This can be done by downloading the updated kernel source code from the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and compiling it according to the provided instructions.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to apply the fix by updating their Linux Kernel to the patched version.
Conclusion
The vulnerability in drm/amd/display that allows for HDCP over-read and corruption has been fixed in Linux Kernel version v5.13.3. Users are advised to update their Linux Kernel to the patched version to mitigate the risk of unauthorized access to HDCP-protected content or manipulation of such content. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
HDCP (High-bandwidth Digital Content Protection) is a security mechanism used to protect copyrighted content from unauthorized access or copying. It ensures that only authorized devices can receive and display HDCP-protected content.
The vulnerability in drm/amd/display allows for HDCP over-read and corruption. This means that the package may read more data than necessary from HDCP-protected content, potentially exposing sensitive information, or manipulate HDCP-protected content, leading to unauthorized access or tampering.
The vulnerability could be exploited by an attacker to bypass HDCP protection and gain access to copyrighted content or manipulate it in unintended ways. This could result in copyright infringement, unauthorized distribution of protected content, or tampering with the integrity of the content.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, and you can upload your manifest file (e.g., package-lock.json) to check if the vulnerability is present.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in fixing the vulnerability in your system.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.