Vulnerability in drm/edid Package: Connector_bad_edid() Function Allows num_of_ext to Exceed num_blocks
Summary
GSD-2021-1001854: drm/edid: In connector_bad_edid() cap num_of_ext by num_blocks read. Affects Kernel versions >= e11f5bd8228fc3760c221f940b9f6365dbf3e7ed, < a7b45024f66f9ec769e8dbb1a51ae83cd05929c7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/edid package is a component of the Linux Kernel that handles Extended Display Identification Data (EDID) for display connectors. EDID is a standardized data structure provided by displays to describe their capabilities and characteristics. The connector_bad_edid() function within the package is responsible for validating the EDID data received from a display connector. However, a vulnerability exists in this function that allows the 'num_of_ext' variable to exceed the 'num_blocks' value, leading to potential memory corruption or information disclosure.
Vulnerability Detail
The vulnerability arises due to a lack of proper bounds checking in the connector_bad_edid() function. An attacker could exploit this issue by providing a specially crafted EDID data that causes the 'num_of_ext' value to be larger than the actual number of extension blocks ('num_blocks'). This can result in reading beyond the allocated memory, potentially leading to arbitrary code execution or leaking sensitive information from kernel memory. Successful exploitation of this vulnerability requires local access to the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the affected display connector or disconnect the display device to prevent potential exploitation of the vulnerability. This can be done by modifying the kernel configuration or using appropriate kernel boot parameters. However, this workaround may result in the loss of display functionality.
Conclusion
The vulnerability in the drm/edid package's connector_bad_edid() function allows for potential memory corruption or information disclosure. Users are advised to update their Linux Kernel to version v5.10.75 or later to mitigate the issue. Disabling the affected display connector or disconnecting the display device can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability allows an attacker with local access to potentially execute arbitrary code or leak sensitive information from kernel memory.
No, this vulnerability requires local access to the affected system for exploitation.
The vulnerability was introduced in Linux Kernel version v5.7 and is present in all versions up to v5.10.74.
There are no known instances of this vulnerability being exploited in the wild.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this one.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
