Vulnerability in drm/nouveau Package: Off-by-One Error in BIOS Boundary Checking
Summary
GSD-2022-1000575: drm/nouveau: fix off by one in BIOS boundary checking. Affects Kernel versions >= 4d4e9907ff572bb1d1c0f6913ad6e3d6d4525077, < d877e814a62b7de9069aeff8bc1d979dfc996e06. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/nouveau package is a component of the Linux Kernel ecosystem. It provides open-source drivers for NVIDIA GPUs. These drivers enable the utilization of NVIDIA graphics hardware on Linux-based systems, allowing for accelerated graphics rendering and improved performance in various applications.
Vulnerability Detail
The vulnerability identified in the drm/nouveau package is an off-by-one error in BIOS boundary checking. This error occurs when validating the boundaries of the Basic Input/Output System (BIOS) data. The off-by-one error can lead to a buffer overflow or underflow, potentially resulting in memory corruption or arbitrary code execution. An attacker with local access to the affected system could exploit this vulnerability to gain elevated privileges or launch further attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
In conclusion, the drm/nouveau package in the Linux Kernel is susceptible to an off-by-one error in BIOS boundary checking. This vulnerability could potentially lead to memory corruption or arbitrary code execution. Users are advised to update their Linux Kernel to version v5.15.22 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability could potentially allow an attacker to execute arbitrary code or gain elevated privileges on the affected system.
No, this vulnerability requires local access to the system to be exploited.
The vulnerability was introduced in version v4.8 of the Linux Kernel and is present until version v5.15.21.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
No, a CVE has not been assigned to this vulnerability at the time of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
