CVE-2024-26699 (GCVE-0-2024-26699)
Vulnerability from cvelistv5
Published
2024-04-03 14:54
Modified
2026-08-05 11:26
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr [Why] There is a potential memory access violation while iterating through array of dcn35 clks. [How] Limit iteration per array size.
References
Impacted products
Vendor Product Version
Linux Linux Version: 8774029f76b9806f2f3586bb0502408076767fd5
Version: 8774029f76b9806f2f3586bb0502408076767fd5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:12.940Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/46806e59a87790760870d216f54951a5b4d545bc"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26699",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:52:47.122143Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:29.383Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb",
              "status": "affected",
              "version": "8774029f76b9806f2f3586bb0502408076767fd5",
              "versionType": "git"
            },
            {
              "lessThan": "46806e59a87790760870d216f54951a5b4d545bc",
              "status": "affected",
              "version": "8774029f76b9806f2f3586bb0502408076767fd5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr\n\n[Why]\nThere is a potential memory access violation while\niterating through array of dcn35 clks.\n\n[How]\nLimit iteration per array size."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is in the amdgpu DC clock-manager initialization path (`dcn35_clk_mgr_construct`), reached only via local driver init/probe on a DCN35 APU; there is no network, adjacent-network, or removable-device path to it. Local system access to the GPU device is what is needed, so Local is the correct and highest defensible vector.\nAC:L - There is no race and no dependency on unpredictable memory layout \u2014 on an affected DCN35 system whose PMFW reports level counts above the driver\u0027s array sizes, the unbounded loops overflow deterministically on every driver initialization. Per the higher-severity rule this is Low rather than High.\nPR:L - The overflow executes in the driver-init path with no credential or capability check of its own, and requires only local access to the amdgpu device rather than verified root in the initial namespace. This matches the established scoring for amdgpu display driver bugs in this subsystem.\nUI:N - The vulnerable helper runs unconditionally during display-core construction (`pstate_enabled` defaults to true for DCN35) with no victim action such as opening a file or plugging in a device. No user interaction is involved.\nS:U - The out-of-bounds read and write both stay within the kernel\u0027s own memory and the driver\u0027s DMA buffer, corrupting kernel data structures managed by the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - `MemPstateTable[]`, `FclkClocks_Freq[]`, `DcfClocks[]` and `SocClocks[]` are read far past their bounds \u2014 up to ~4 KB beyond the single-page VRAM buffer \u2014 and the resulting adjacent memory contents are propagated into `bw_params-\u003eclk_table.entries[]`, which is surfaced through DC logging and clock reporting. This is an unbounded OOB read leveraged for information disclosure.\nI:H - `bw_params-\u003eclk_table.entries[i]` is written for `i` bounded only by an attacker/firmware-supplied `uint8_t`, against an 8-element array, giving an out-of-bounds write of up to ~10 KB of partly firmware-controlled data past the static `dcn35_bw_params` global into adjacent kernel `.data`. Such adjacent-global corruption is exploitable for control-flow or state manipulation.\nA:H - The OOB read walks off the end of the one-page VRAM BO mapping and the OOB write smashes neighbouring kernel globals, producing oops/panic or a corrupted display clock state at boot. Any kernel crash of this kind is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:46.401Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/46806e59a87790760870d216f54951a5b4d545bc"
        }
      ],
      "title": "drm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26699",
    "datePublished": "2024-04-03T14:54:59.268Z",
    "dateReserved": "2024-02-19T14:20:24.157Z",
    "dateUpdated": "2026-08-05T11:26:46.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/46806e59a87790760870d216f54951a5b4d545bc\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:12.940Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26699\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:52:47.122143Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:16.947Z\"}}], \"cna\": {\"title\": \"drm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is in the amdgpu DC clock-manager initialization path (`dcn35_clk_mgr_construct`), reached only via local driver init/probe on a DCN35 APU; there is no network, adjacent-network, or removable-device path to it. Local system access to the GPU device is what is needed, so Local is the correct and highest defensible vector.\\nAC:L - There is no race and no dependency on unpredictable memory layout \\u2014 on an affected DCN35 system whose PMFW reports level counts above the driver\u0027s array sizes, the unbounded loops overflow deterministically on every driver initialization. Per the higher-severity rule this is Low rather than High.\\nPR:L - The overflow executes in the driver-init path with no credential or capability check of its own, and requires only local access to the amdgpu device rather than verified root in the initial namespace. This matches the established scoring for amdgpu display driver bugs in this subsystem.\\nUI:N - The vulnerable helper runs unconditionally during display-core construction (`pstate_enabled` defaults to true for DCN35) with no victim action such as opening a file or plugging in a device. No user interaction is involved.\\nS:U - The out-of-bounds read and write both stay within the kernel\u0027s own memory and the driver\u0027s DMA buffer, corrupting kernel data structures managed by the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - `MemPstateTable[]`, `FclkClocks_Freq[]`, `DcfClocks[]` and `SocClocks[]` are read far past their bounds \\u2014 up to ~4 KB beyond the single-page VRAM buffer \\u2014 and the resulting adjacent memory contents are propagated into `bw_params-\u003eclk_table.entries[]`, which is surfaced through DC logging and clock reporting. This is an unbounded OOB read leveraged for information disclosure.\\nI:H - `bw_params-\u003eclk_table.entries[i]` is written for `i` bounded only by an attacker/firmware-supplied `uint8_t`, against an 8-element array, giving an out-of-bounds write of up to ~10 KB of partly firmware-controlled data past the static `dcn35_bw_params` global into adjacent kernel `.data`. Such adjacent-global corruption is exploitable for control-flow or state manipulation.\\nA:H - The OOB read walks off the end of the one-page VRAM BO mapping and the OOB write smashes neighbouring kernel globals, producing oops/panic or a corrupted display clock state at boot. Any kernel crash of this kind is High.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8774029f76b9806f2f3586bb0502408076767fd5\", \"lessThan\": \"ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8774029f76b9806f2f3586bb0502408076767fd5\", \"lessThan\": \"46806e59a87790760870d216f54951a5b4d545bc\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.7.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb\"}, {\"url\": \"https://git.kernel.org/stable/c/46806e59a87790760870d216f54951a5b4d545bc\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: Fix array-index-out-of-bounds in dcn35_clkmgr\\n\\n[Why]\\nThere is a potential memory access violation while\\niterating through array of dcn35 clks.\\n\\n[How]\\nLimit iteration per array size.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.6\", \"versionStartIncluding\": \"6.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:26:46.401Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26699\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:26:46.401Z\", \"dateReserved\": \"2024-02-19T14:20:24.157Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-03T14:54:59.268Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.