Vulnerability in drm/edid Package: Connector_bad_edid() Function Allows num_of_ext to Exceed num_blocks
Summary
UVI-2021-1001854: drm/edid: In connector_bad_edid() cap num_of_ext by num_blocks read. Affects Kernel versions >= e11f5bd8228fc3760c221f940b9f6365dbf3e7ed, < a7b45024f66f9ec769e8dbb1a51ae83cd05929c7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The drm/edid package is a component of the Linux Kernel that handles Extended Display Identification Data (EDID) for display connectors. EDID provides information about the capabilities and characteristics of a display device. The connector_bad_edid() function in the package is responsible for validating the EDID data received from a display connector. However, a vulnerability exists in this function that allows the 'num_of_ext' value to exceed the 'num_blocks' value, leading to a potential out-of-bounds read.
Vulnerability Detail
The vulnerability arises due to a lack of proper bounds checking in the connector_bad_edid() function. An attacker could exploit this issue by providing a specially crafted EDID data that causes 'num_of_ext' to be larger than 'num_blocks'. This could result in reading beyond the allocated memory, potentially leading to information disclosure or a denial-of-service condition. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The vulnerability in the drm/edid package's connector_bad_edid() function allows 'num_of_ext' to exceed 'num_blocks', potentially leading to an out-of-bounds read. It is crucial to update the Linux Kernel to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The drm/edid package is a component of the Linux Kernel that handles Extended Display Identification Data (EDID) for display connectors.
The connector_bad_edid() function is responsible for validating the EDID data received from a display connector.
The vulnerability occurs due to a lack of proper bounds checking in the connector_bad_edid() function, allowing 'num_of_ext' to exceed 'num_blocks'.
The vulnerability could potentially lead to information disclosure or a denial-of-service condition.
No, the impact and attack plausibility of this vulnerability have not been proven yet.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
