Vulnerability in drm/nouveau package: Off-by-One Error in BIOS Boundary Checking
Summary
GSD-2022-1000171: drm/nouveau: fix off by one in BIOS boundary checking. Affects Kernel versions >= 4d4e9907ff572bb1d1c0f6913ad6e3d6d4525077, < acc887ba88333f5fec49631f12d8cc7ebd95781c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/nouveau package is a component of the Linux Kernel ecosystem. It provides support for NVIDIA graphics cards using the Nouveau driver. The package enables the display and rendering capabilities of these graphics cards on Linux systems. The vulnerability in question is an off-by-one error in the BIOS boundary checking functionality of the package.
Vulnerability Detail
The off-by-one error in the BIOS boundary checking of the drm/nouveau package allows for potential security vulnerabilities. Although the actual impact and attack plausibility have not been proven, this vulnerability could potentially be exploited by attackers to gain unauthorized access or execute arbitrary code. The error was introduced in version v4.8 of the Linux Kernel and was fixed in version v5.4.178.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the drm/nouveau package in the Linux Kernel is vulnerable to an off-by-one error in BIOS boundary checking. This vulnerability could potentially be exploited by attackers to gain unauthorized access or execute arbitrary code. It is recommended to update the Linux Kernel to version v5.4.178 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it could potentially allow attackers to gain unauthorized access or execute arbitrary code.
You can use Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it in real-time.
There is no known exploit for this vulnerability at the moment.
The recommended mitigation is to update the Linux Kernel to version v5.4.178 or later.
You can find more information about this vulnerability in the GSD-2022-1000171.json file available in the GSD database (https://github.com/cloudsecurityalliance/gsd-database).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
