Vulnerability in drm/edid Package: Connector_bad_edid() Function Allows num_of_ext to Exceed num_blocks
Summary
GSD-2021-1002089: drm/edid: In connector_bad_edid() cap num_of_ext by num_blocks read. Affects Kernel versions >= e11f5bd8228fc3760c221f940b9f6365dbf3e7ed, < 09f3946bb452918dbfb1982add56f9ffaae393dc. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/edid package is a component of the Linux Kernel ecosystem. It is responsible for handling Extended Display Identification Data (EDID) in the Direct Rendering Manager (DRM) subsystem. EDID provides information about the capabilities and characteristics of display devices connected to a system. The connector_bad_edid() function within this package is designed to validate the EDID data received from a display device. However, a vulnerability exists in this function that allows the 'num_of_ext' value to exceed the 'num_blocks' value, potentially leading to memory corruption or other security issues.
Vulnerability Detail
The vulnerability arises due to a lack of proper bounds checking in the connector_bad_edid() function. An attacker could exploit this vulnerability by providing a malicious EDID data block with a 'num_of_ext' value that exceeds the actual number of extension blocks ('num_blocks'). This could result in reading beyond the allocated memory, leading to information disclosure or arbitrary code execution. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the use of EDID data by configuring their system to use a fixed display mode. This can be achieved by modifying the display configuration settings in the system's graphics driver or using specific kernel parameters. However, this workaround may limit the system's ability to adapt to different display devices and should be considered temporary until the Kernel update can be applied.
Conclusion
The vulnerability in the drm/edid package's connector_bad_edid() function allows the 'num_of_ext' value to exceed the 'num_blocks' value, potentially leading to memory corruption or other security issues. It is crucial to update the Linux Kernel to version v5.14.14 or later to fix this vulnerability. In the meantime, a temporary workaround is available by disabling the use of EDID data, but this may limit the system's display adaptability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The drm/edid package is responsible for handling Extended Display Identification Data (EDID) in the Linux Kernel's Direct Rendering Manager (DRM) subsystem. It provides information about the capabilities and characteristics of display devices connected to a system.
The vulnerability arises due to a lack of proper bounds checking in the connector_bad_edid() function. It allows the 'num_of_ext' value to exceed the actual number of extension blocks ('num_blocks'), potentially leading to memory corruption or other security issues.
Exploiting this vulnerability could result in reading beyond the allocated memory, leading to information disclosure or arbitrary code execution. However, the actual impact and attack plausibility have not been proven yet.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.14.14 or later. This update ensures that the connector_bad_edid() function correctly validates the 'num_of_ext' value against the 'num_blocks' value, preventing any potential memory corruption or security issues.
Yes, users can disable the use of EDID data by configuring their system to use a fixed display mode. This can be done through the system's graphics driver settings or by using specific kernel parameters. However, this workaround may limit the system's ability to adapt to different display devices and should be considered temporary until the Kernel update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
