CVE-2024-38552 (GCVE-0-2024-38552)
Vulnerability from cvelistv5
Published
2024-06-19 13:35
Modified
2026-08-05 11:32
Severity ?
7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential index out of bounds in color transformation function Fixes index out of bounds issue in the color transformation function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS). The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds, an error message is logged and the function returns false to indicate an error. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max
References
Impacted products
Vendor Product Version
Linux Linux Version: b629596072e5fa901c84f9e88d845a696ee32942
Version: b629596072e5fa901c84f9e88d845a696ee32942
Version: b629596072e5fa901c84f9e88d845a696ee32942
Version: b629596072e5fa901c84f9e88d845a696ee32942
Version: b629596072e5fa901c84f9e88d845a696ee32942
Version: b629596072e5fa901c84f9e88d845a696ee32942
Version: b629596072e5fa901c84f9e88d845a696ee32942
Version: b629596072e5fa901c84f9e88d845a696ee32942
Version: b629596072e5fa901c84f9e88d845a696ee32942
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:21:24.332Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/604c506ca43fce52bb882cff9c1fdf2ec3b4029c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e280ab978c81443103d7c61bdd1d8d708cf6ed6d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/04bc4d1090c343025d69149ca669a27c5b9c34a7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ced9c4e2289a786b8fa684d8893b7045ea53ef7e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/98b8a6bfd30d07a19cfacdf82b50f84bf3360869"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/63ae548f1054a0b71678d0349c7dc9628ddd42ca"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38552",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:14:50.788974Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:57.332Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:54:36.137Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "604c506ca43fce52bb882cff9c1fdf2ec3b4029c",
              "status": "affected",
              "version": "b629596072e5fa901c84f9e88d845a696ee32942",
              "versionType": "git"
            },
            {
              "lessThan": "e280ab978c81443103d7c61bdd1d8d708cf6ed6d",
              "status": "affected",
              "version": "b629596072e5fa901c84f9e88d845a696ee32942",
              "versionType": "git"
            },
            {
              "lessThan": "04bc4d1090c343025d69149ca669a27c5b9c34a7",
              "status": "affected",
              "version": "b629596072e5fa901c84f9e88d845a696ee32942",
              "versionType": "git"
            },
            {
              "lessThan": "ced9c4e2289a786b8fa684d8893b7045ea53ef7e",
              "status": "affected",
              "version": "b629596072e5fa901c84f9e88d845a696ee32942",
              "versionType": "git"
            },
            {
              "lessThan": "98b8a6bfd30d07a19cfacdf82b50f84bf3360869",
              "status": "affected",
              "version": "b629596072e5fa901c84f9e88d845a696ee32942",
              "versionType": "git"
            },
            {
              "lessThan": "4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86",
              "status": "affected",
              "version": "b629596072e5fa901c84f9e88d845a696ee32942",
              "versionType": "git"
            },
            {
              "lessThan": "123edbae64f4d21984359b99c6e79fcde31c6123",
              "status": "affected",
              "version": "b629596072e5fa901c84f9e88d845a696ee32942",
              "versionType": "git"
            },
            {
              "lessThan": "7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29",
              "status": "affected",
              "version": "b629596072e5fa901c84f9e88d845a696ee32942",
              "versionType": "git"
            },
            {
              "lessThan": "63ae548f1054a0b71678d0349c7dc9628ddd42ca",
              "status": "affected",
              "version": "b629596072e5fa901c84f9e88d845a696ee32942",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.316",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.278",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.219",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.316",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.278",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.219",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.161",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix potential index out of bounds in color transformation function\n\nFixes index out of bounds issue in the color transformation function.\nThe issue could occur when the index \u0027i\u0027 exceeds the number of transfer\nfunction points (TRANSFER_FUNC_POINTS).\n\nThe fix adds a check to ensure \u0027i\u0027 is within bounds before accessing the\ntransfer function points. If \u0027i\u0027 is out of bounds, an error message is\nlogged and the function returns false to indicate an error.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: buffer overflow \u0027output_tf-\u003etf_pts.red\u0027 1025 \u003c= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: buffer overflow \u0027output_tf-\u003etf_pts.green\u0027 1025 \u003c= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 cm_helper_translate_curve_to_hw_format() error: buffer overflow \u0027output_tf-\u003etf_pts.blue\u0027 1025 \u003c= s32max"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The code is reached only through the DRM atomic modeset ioctl on /dev/dri/cardN (amdgpu_dm color management \u2192 dcn*_set_output_transfer_func); there is no network or remote-peer path into the AMD display color pipeline.\nAC:L - The attacker directly supplies the GAMMA_LUT/DEGAMMA_LUT blobs and the shaper/blend transfer-function enums that drive the loop, and can re-issue the atomic commit at will with no race and no dependence on unpredictable system state.\nPR:L - DRM_IOCTL_MODE_ATOMIC is gated on DRM_MASTER (drm_ioctl.c:701), which the logged-in seat user or a member of the video group holds on the active VT \u2014 no root or CAP_SYS_ADMIN is required.\nUI:N - The attacker performs the atomic commit itself; no victim action, no filesystem mount, and no separate user interaction is needed.\nS:U - The out-of-bounds access stays within the kernel\u0027s own memory and the amdgpu driver\u0027s security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The flagged defect is an unbounded out-of-bounds read past the 1025-entry tf_pts arrays inside the kernel heap object, not a read strictly bounded to a few bytes, so adjacent kernel heap contents can be sampled and pushed into the display pipeline.\nI:L - The out-of-bounds values are converted and programmed into the DPP regamma/shaper hardware LUT, corrupting display output with attacker-uncontrolled kernel data; there is no out-of-bounds write and no control-flow hijack primitive, so impact is limited.\nA:H - An out-of-bounds read at a large index can touch an unmapped page or trip KASAN/hardened-usercopy checks, oopsing in the atomic commit path while display locks are held, and an unprivileged seat user can retrigger it in a loop."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:43.970Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/604c506ca43fce52bb882cff9c1fdf2ec3b4029c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e280ab978c81443103d7c61bdd1d8d708cf6ed6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/04bc4d1090c343025d69149ca669a27c5b9c34a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/ced9c4e2289a786b8fa684d8893b7045ea53ef7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/98b8a6bfd30d07a19cfacdf82b50f84bf3360869"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86"
        },
        {
          "url": "https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123"
        },
        {
          "url": "https://git.kernel.org/stable/c/7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29"
        },
        {
          "url": "https://git.kernel.org/stable/c/63ae548f1054a0b71678d0349c7dc9628ddd42ca"
        }
      ],
      "title": "drm/amd/display: Fix potential index out of bounds in color transformation function",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38552",
    "datePublished": "2024-06-19T13:35:24.067Z",
    "dateReserved": "2024-06-18T19:36:34.920Z",
    "dateUpdated": "2026-08-05T11:32:43.970Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/604c506ca43fce52bb882cff9c1fdf2ec3b4029c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e280ab978c81443103d7c61bdd1d8d708cf6ed6d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/04bc4d1090c343025d69149ca669a27c5b9c34a7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ced9c4e2289a786b8fa684d8893b7045ea53ef7e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/98b8a6bfd30d07a19cfacdf82b50f84bf3360869\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/63ae548f1054a0b71678d0349c7dc9628ddd42ca\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T17:21:24.332Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T11:54:36.137Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-38552\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:14:50.788974Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:27.134Z\"}}], \"cna\": {\"title\": \"drm/amd/display: Fix potential index out of bounds in color transformation function\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The code is reached only through the DRM atomic modeset ioctl on /dev/dri/cardN (amdgpu_dm color management \\u2192 dcn*_set_output_transfer_func); there is no network or remote-peer path into the AMD display color pipeline.\\nAC:L - The attacker directly supplies the GAMMA_LUT/DEGAMMA_LUT blobs and the shaper/blend transfer-function enums that drive the loop, and can re-issue the atomic commit at will with no race and no dependence on unpredictable system state.\\nPR:L - DRM_IOCTL_MODE_ATOMIC is gated on DRM_MASTER (drm_ioctl.c:701), which the logged-in seat user or a member of the video group holds on the active VT \\u2014 no root or CAP_SYS_ADMIN is required.\\nUI:N - The attacker performs the atomic commit itself; no victim action, no filesystem mount, and no separate user interaction is needed.\\nS:U - The out-of-bounds access stays within the kernel\u0027s own memory and the amdgpu driver\u0027s security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The flagged defect is an unbounded out-of-bounds read past the 1025-entry tf_pts arrays inside the kernel heap object, not a read strictly bounded to a few bytes, so adjacent kernel heap contents can be sampled and pushed into the display pipeline.\\nI:L - The out-of-bounds values are converted and programmed into the DPP regamma/shaper hardware LUT, corrupting display output with attacker-uncontrolled kernel data; there is no out-of-bounds write and no control-flow hijack primitive, so impact is limited.\\nA:H - An out-of-bounds read at a large index can touch an unmapped page or trip KASAN/hardened-usercopy checks, oopsing in the atomic commit path while display locks are held, and an unprivileged seat user can retrigger it in a loop.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b629596072e5fa901c84f9e88d845a696ee32942\", \"lessThan\": \"604c506ca43fce52bb882cff9c1fdf2ec3b4029c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b629596072e5fa901c84f9e88d845a696ee32942\", \"lessThan\": \"e280ab978c81443103d7c61bdd1d8d708cf6ed6d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b629596072e5fa901c84f9e88d845a696ee32942\", \"lessThan\": \"04bc4d1090c343025d69149ca669a27c5b9c34a7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b629596072e5fa901c84f9e88d845a696ee32942\", \"lessThan\": \"ced9c4e2289a786b8fa684d8893b7045ea53ef7e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b629596072e5fa901c84f9e88d845a696ee32942\", \"lessThan\": \"98b8a6bfd30d07a19cfacdf82b50f84bf3360869\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b629596072e5fa901c84f9e88d845a696ee32942\", \"lessThan\": \"4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b629596072e5fa901c84f9e88d845a696ee32942\", \"lessThan\": \"123edbae64f4d21984359b99c6e79fcde31c6123\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b629596072e5fa901c84f9e88d845a696ee32942\", \"lessThan\": \"7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b629596072e5fa901c84f9e88d845a696ee32942\", \"lessThan\": \"63ae548f1054a0b71678d0349c7dc9628ddd42ca\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.316\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.278\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.219\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.161\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/604c506ca43fce52bb882cff9c1fdf2ec3b4029c\"}, {\"url\": \"https://git.kernel.org/stable/c/e280ab978c81443103d7c61bdd1d8d708cf6ed6d\"}, {\"url\": \"https://git.kernel.org/stable/c/04bc4d1090c343025d69149ca669a27c5b9c34a7\"}, {\"url\": \"https://git.kernel.org/stable/c/ced9c4e2289a786b8fa684d8893b7045ea53ef7e\"}, {\"url\": \"https://git.kernel.org/stable/c/98b8a6bfd30d07a19cfacdf82b50f84bf3360869\"}, {\"url\": \"https://git.kernel.org/stable/c/4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86\"}, {\"url\": \"https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123\"}, {\"url\": \"https://git.kernel.org/stable/c/7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29\"}, {\"url\": \"https://git.kernel.org/stable/c/63ae548f1054a0b71678d0349c7dc9628ddd42ca\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: Fix potential index out of bounds in color transformation function\\n\\nFixes index out of bounds issue in the color transformation function.\\nThe issue could occur when the index \u0027i\u0027 exceeds the number of transfer\\nfunction points (TRANSFER_FUNC_POINTS).\\n\\nThe fix adds a check to ensure \u0027i\u0027 is within bounds before accessing the\\ntransfer function points. If \u0027i\u0027 is out of bounds, an error message is\\nlogged and the function returns false to indicate an error.\\n\\nReported by smatch:\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: buffer overflow \u0027output_tf-\u003etf_pts.red\u0027 1025 \u003c= s32max\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: buffer overflow \u0027output_tf-\u003etf_pts.green\u0027 1025 \u003c= s32max\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 cm_helper_translate_curve_to_hw_format() error: buffer overflow \u0027output_tf-\u003etf_pts.blue\u0027 1025 \u003c= s32max\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.316\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.278\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.219\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.161\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.93\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.33\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.12\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.3\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"4.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:32:43.970Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-38552\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:32:43.970Z\", \"dateReserved\": \"2024-06-18T19:36:34.920Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-19T13:35:24.067Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.