Vulnerability in drm/amd/display package: Call dc_stream_release for remove link enc assignment
Summary
GSD-2022-1001240: drm/amd/display: Call dc_stream_release for remove link enc assignment. Affects Kernel versions >= 0bb24555858403671657f6dc025d2931e3e857bb, < a28b7b6a0c827ce672edcdb5b2b5916b0beebe03. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/amd/display package is a component of the Linux Kernel that handles display functionality for AMD graphics cards. It provides the necessary drivers and interfaces for managing display outputs, including link encoders. Link encoders are responsible for converting digital display data into a format that can be transmitted over a physical connection, such as HDMI or DisplayPort. This vulnerability specifically affects the handling of link enc assignments, where a failure to properly release resources can lead to potential security issues.
Vulnerability Detail
The vulnerability arises from a missing call to the 'dc_stream_release' function when removing a link enc assignment in the drm/amd/display package. This omission can result in the improper handling of resources, potentially leading to memory leaks or other security vulnerabilities. While the exact impact and attack vectors have not been proven, it is crucial to address this issue to ensure the integrity and security of the display functionality on systems utilizing AMD graphics cards.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually apply the fix by modifying the affected code in the drm/amd/display package. The following code snippet demonstrates the addition of the 'dc_stream_release' function call:
// Original code
...
remove_link_enc_assignment(...);
...
// Modified code
...
remove_link_enc_assignment(...);
dc_stream_release(...);
...
Conclusion
In conclusion, the vulnerability in the drm/amd/display package related to the missing 'dc_stream_release' function call when removing a link enc assignment can potentially lead to security issues and compromised display functionality on systems utilizing AMD graphics cards. It is crucial to update the Linux Kernel to version v5.17.2 or later to address this vulnerability. Alternatively, users can apply the provided workaround until the update is applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The exact impact of this vulnerability is yet to be proven. However, it has the potential to result in memory leaks or other security vulnerabilities, compromising the integrity and security of the display functionality on systems utilizing AMD graphics cards.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert analyzes manifest files like package-lock.json to identify and alert for open-source vulnerabilities in software, without requiring access to the code or installation.
Yes, a temporary workaround is available. Users can manually modify the affected code in the drm/amd/display package to include the missing 'dc_stream_release' function call. Please refer to the 'workaround' section for the code snippet and instructions.
Yes, this vulnerability has been fixed in Linux Kernel version v5.17.2. It was addressed through commit 'a28b7b6a0c827ce672edcdb5b2b5916b0beebe03'. It is recommended to update to this version or a later one to ensure the vulnerability is mitigated.
You can find more information about this vulnerability, including the specific commit that fixed it, in the vulnerability database maintained by the Cloud Security Alliance. The source link is provided in the 'affected' section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
