CVE-2022-48979 (GCVE-0-2022-48979)
Vulnerability from cvelistv5
Published
2024-10-21 20:05
Modified
2026-08-12 23:57
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix array index out of bound error in DCN32 DML [Why&How] LinkCapacitySupport array is indexed with the number of voltage states and not the number of max DPPs. Fix the error by changing the array declaration to use the correct (larger) array size of total number of voltage states.
References
Impacted products
Vendor Product Version
Linux Linux Version: 74458c081fcfb0423877e630de2746daefdb16e4
Version: 74458c081fcfb0423877e630de2746daefdb16e4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48979",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:18:06.288121Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:18:44.044Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3d8a298b2e83b98042e6ec726e934f535b23e6aa",
              "status": "affected",
              "version": "74458c081fcfb0423877e630de2746daefdb16e4",
              "versionType": "git"
            },
            {
              "lessThan": "aeffc8fb2174f017a10df114bc312f899904dc68",
              "status": "affected",
              "version": "74458c081fcfb0423877e630de2746daefdb16e4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.13",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix array index out of bound error in DCN32 DML\n\n[Why\u0026How]\nLinkCapacitySupport array is indexed with the number of voltage states and\nnot the number of max DPPs. Fix the error by changing the array\ndeclaration to use the correct (larger) array size of total number of\nvoltage states."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached via DRM atomic modesetting (DRM_IOCTL_MODE_ATOMIC) into amdgpu_dm validation and DCN32 DML (dml32_ModeSupportAndSystemConfigurationFull); exploitation requires local access to the DRM device, not network or adjacent-network reachability.\nAC:L - On affected DCN32 hardware, synthetic/legacy SOC state construction routinely builds more than DC__NUM_DPP__MAX (8) voltage states (up to DC__VOLTAGE_STATES=20), so mode validation reliably indexes past the undersized LinkCapacitySupport array with no race or attacker-uncontrollable condition.\nPR:L - Triggering requires DRM master for atomic modeset, which an unprivileged local user with seat/video access can obtain (first opener of the primary node becomes master without CAP_SYS_ADMIN; compositors also run as the logged-in user), matching other amd/display OOB scores.\nUI:N - The attacker initiates the modeset/ioctl themselves; no separate victim action is required.\nS:U - Impact is confined to kernel memory within the same host security authority (standard local kernel memory corruption / privilege-escalation scope), with no VM escape or IOMMU boundary crossing.\nC:H - Out-of-bounds indexing of LinkCapacitySupport both writes past the array into adjacent vba_vars_st fields and reads those adjacent bytes as mode-support flags; kernel memory corruption of this class is treated as enabling high confidentiality impact.\nI:H - The bug is an out-of-bounds write of bool values into neighboring DML state (VREADY_AT_OR_AFTER_VSYNC, MIN_DST_Y_NEXT_START, and beyond), which is kernel memory corruption usable for integrity impact and control-flow/state corruption.\nA:H - Corrupting adjacent mode-programming state can cause kernel oops/panic or otherwise fatal misbehavior during display bandwidth validation and subsequent programming."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T23:57:22.747Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3d8a298b2e83b98042e6ec726e934f535b23e6aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/aeffc8fb2174f017a10df114bc312f899904dc68"
        }
      ],
      "title": "drm/amd/display: fix array index out of bound error in DCN32 DML",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48979",
    "datePublished": "2024-10-21T20:05:57.707Z",
    "dateReserved": "2024-08-22T01:27:53.632Z",
    "dateUpdated": "2026-08-12T23:57:22.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48979\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:18:06.288121Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:18:09.448Z\"}}], \"cna\": {\"title\": \"drm/amd/display: fix array index out of bound error in DCN32 DML\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached via DRM atomic modesetting (DRM_IOCTL_MODE_ATOMIC) into amdgpu_dm validation and DCN32 DML (dml32_ModeSupportAndSystemConfigurationFull); exploitation requires local access to the DRM device, not network or adjacent-network reachability.\\nAC:L - On affected DCN32 hardware, synthetic/legacy SOC state construction routinely builds more than DC__NUM_DPP__MAX (8) voltage states (up to DC__VOLTAGE_STATES=20), so mode validation reliably indexes past the undersized LinkCapacitySupport array with no race or attacker-uncontrollable condition.\\nPR:L - Triggering requires DRM master for atomic modeset, which an unprivileged local user with seat/video access can obtain (first opener of the primary node becomes master without CAP_SYS_ADMIN; compositors also run as the logged-in user), matching other amd/display OOB scores.\\nUI:N - The attacker initiates the modeset/ioctl themselves; no separate victim action is required.\\nS:U - Impact is confined to kernel memory within the same host security authority (standard local kernel memory corruption / privilege-escalation scope), with no VM escape or IOMMU boundary crossing.\\nC:H - Out-of-bounds indexing of LinkCapacitySupport both writes past the array into adjacent vba_vars_st fields and reads those adjacent bytes as mode-support flags; kernel memory corruption of this class is treated as enabling high confidentiality impact.\\nI:H - The bug is an out-of-bounds write of bool values into neighboring DML state (VREADY_AT_OR_AFTER_VSYNC, MIN_DST_Y_NEXT_START, and beyond), which is kernel memory corruption usable for integrity impact and control-flow/state corruption.\\nA:H - Corrupting adjacent mode-programming state can cause kernel oops/panic or otherwise fatal misbehavior during display bandwidth validation and subsequent programming.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"74458c081fcfb0423877e630de2746daefdb16e4\", \"lessThan\": \"3d8a298b2e83b98042e6ec726e934f535b23e6aa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"74458c081fcfb0423877e630de2746daefdb16e4\", \"lessThan\": \"aeffc8fb2174f017a10df114bc312f899904dc68\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.0.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.0.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3d8a298b2e83b98042e6ec726e934f535b23e6aa\"}, {\"url\": \"https://git.kernel.org/stable/c/aeffc8fb2174f017a10df114bc312f899904dc68\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: fix array index out of bound error in DCN32 DML\\n\\n[Why\u0026How]\\nLinkCapacitySupport array is indexed with the number of voltage states and\\nnot the number of max DPPs. Fix the error by changing the array\\ndeclaration to use the correct (larger) array size of total number of\\nvoltage states.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.0.13\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1\", \"versionStartIncluding\": \"5.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-12T23:57:22.747Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48979\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-12T23:57:22.747Z\", \"dateReserved\": \"2024-08-22T01:27:53.632Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T20:05:57.707Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.