{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-46812", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-11T15:12:18.283Z", "datePublished": "2024-09-27T12:35:55.118Z", "dateUpdated": "2026-08-05T11:38:43.865Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:38:43.865Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration\n\n[Why]\nCoverity reports Memory - illegal accesses.\n\n[How]\nSkip inactive planes." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable DML code is reached only through DRM modesetting ioctls (DRM_IOCTL_MODE_ATOMIC, SETCRTC, page flip) on the local /dev/dri/card0 device node via amdgpu_dm_atomic_check() → dc_validate_global_state() → validate_bandwidth(). There is no network or remote input path into the display mode library.\nAC:L - The attacker fully controls the plane/pipe topology submitted in the atomic state (plane count, hsplit/ODM grouping, viewports) and can repeatedly resubmit configurations, including via the non-committing TEST_ONLY atomic path, with no reliance on timing, memory layout, or victim state.\nPR:L - An unprivileged local user with an open handle on the DRM card node and DRM master — the normal state for the active graphical session user on a desktop, kiosk, or Android/ChromeOS device — can drive atomic checks; no CAP_SYS_ADMIN or root is required anywhere on the path.\nUI:N - The attacker triggers the modeset validation entirely from its own process by issuing ioctls; no action by another user or administrator is needed.\nS:U - The illegal access occurs in kernel memory within the amdgpu display driver's own context, and both the vulnerability and its impact remain within the kernel's security authority with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The unsigned wrap of the -1 return produces an index of 0xFFFFFFFF into cache_pipes[], reading kernel memory ~2.5 TB outside the array at a wholly out-of-bounds address; the fetched value propagates into vba.DPPCLK[] and onward into clock programming and DML debug/state readback, so the out-of-bounds read is treated as High.\nI:H - The wild-read value is stored into vba.DPPCLK[k] and consumed by subsequent bandwidth/watermark calculation and DPP clock programming, letting uncontrolled out-of-bounds memory contents corrupt driver state and hardware clock configuration; consistent with how comparable drm/amd/display out-of-bound access fixes are scored.\nA:H - The ASSERT() fires WARN_ON_ONCE (a panic under panic_on_warn) and execution then dereferences a wild pointer at base + 0xFFFFFFFF * sizeof(display_e2e_pipe_params_st), which lands in unmapped memory and oopses the kernel; a bogus DPPCLK value can additionally hang the display pipeline." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c" ], "versions": [ { "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c", "lessThan": "2fd32a65f2e78eff0862c8fdf7815ca6bb44fb2e", "status": "affected", "versionType": "git" }, { "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c", "lessThan": "4331ae2788e779b11f3aad40c04be6c64831f2a2", "status": "affected", "versionType": "git" }, { "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c", "lessThan": "3300a039caf850376bc3416c808cd8879da412bb", "status": "affected", "versionType": "git" }, { "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c", "lessThan": "8406158a546441b73f0b216aedacbf9a1e5748fb", "status": "affected", "versionType": "git" }, { "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c", "lessThan": "ee9d6df6d9172917d9ddbd948bb882652d5ecd29", "status": "affected", "versionType": "git" }, { "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c", "lessThan": "a54f7e866cc73a4cb71b8b24bb568ba35c8969df", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.c" ], "versions": [ { "version": "4.15", "status": "affected" }, { "version": "0", "lessThan": "4.15", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.236", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.180", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.109", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.50", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.9", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.10.236" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.15.180" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.1.109" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.6.50" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.10.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/2fd32a65f2e78eff0862c8fdf7815ca6bb44fb2e" }, { "url": "https://git.kernel.org/stable/c/4331ae2788e779b11f3aad40c04be6c64831f2a2" }, { "url": "https://git.kernel.org/stable/c/3300a039caf850376bc3416c808cd8879da412bb" }, { "url": "https://git.kernel.org/stable/c/8406158a546441b73f0b216aedacbf9a1e5748fb" }, { "url": "https://git.kernel.org/stable/c/ee9d6df6d9172917d9ddbd948bb882652d5ecd29" }, { "url": "https://git.kernel.org/stable/c/a54f7e866cc73a4cb71b8b24bb568ba35c8969df" } ], "title": "drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-09-29T14:18:49.737010Z", "id": "CVE-2024-46812", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T14:19:03.191Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:18:53.441Z" } } ] } }