CVE-2024-49969

drm/amd/display: Fix index out of bounds in DCN30 color transformation

State: Published
Severity: 7.8 High
Published: Oct 21, 2024
Updated: Aug 5, 2026
Reserved: Oct 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix index out of bounds in DCN30 color transformation

This commit addresses a potential index out of bounds issue in the `cm3_helper_translate_curve_to_hw_format` function in the DCN30 color management module. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS).

The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds, the function returns false to indicate an error.

drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:180 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:181 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:182 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	03f54d7d3448dc1668568d1adb69b43c1d1dc79f to before 7ab69af56a23859b647dee69fa1052c689343621Affected 03f54d7d3448dc1668568d1adb69b43c1d1dc79f to before c13f9c62015c56a938304cef6d507227ea3e0039Affected 03f54d7d3448dc1668568d1adb69b43c1d1dc79f to before 0f1e222a4b41d77c442901d166fbdca967af0d86Affected 03f54d7d3448dc1668568d1adb69b43c1d1dc79f to before 929506d5671419cffd8d01e9a7f5eae53682a838Affected 03f54d7d3448dc1668568d1adb69b43c1d1dc79f to before 578422ddae3d13362b64e77ef9bab98780641631Affected 03f54d7d3448dc1668568d1adb69b43c1d1dc79f to before b9d8b94ec7e67f0cae228c054f77b73967c389a3Affected 03f54d7d3448dc1668568d1adb69b43c1d1dc79f to before d81873f9e715b72d4f8d391c8eb243946f784dfcAffected
LinuxLinux	5.9Affected before 5.9Not affected 5.10.227 through 5.10.Not affected 5.15.168 through 5.15.Not affected 6.1.113 through 6.1.Not affected 6.6.55 through 6.6.Not affected 6.10.14 through 6.10.Not affected 6.11.3 through 6.11.Not affected 6.12 and laterNot affected

Product

Versions

LinuxLinux

03f54d7d3448dc1668568d1adb69b43c1d1dc79f to before 7ab69af56a23859b647dee69fa1052c689343621Affected
03f54d7d3448dc1668568d1adb69b43c1d1dc79f to before c13f9c62015c56a938304cef6d507227ea3e0039Affected
03f54d7d3448dc1668568d1adb69b43c1d1dc79f to before 0f1e222a4b41d77c442901d166fbdca967af0d86Affected
03f54d7d3448dc1668568d1adb69b43c1d1dc79f to before 929506d5671419cffd8d01e9a7f5eae53682a838Affected
03f54d7d3448dc1668568d1adb69b43c1d1dc79f to before 578422ddae3d13362b64e77ef9bab98780641631Affected
03f54d7d3448dc1668568d1adb69b43c1d1dc79f to before b9d8b94ec7e67f0cae228c054f77b73967c389a3Affected
03f54d7d3448dc1668568d1adb69b43c1d1dc79f to before d81873f9e715b72d4f8d391c8eb243946f784dfcAffected

LinuxLinux

5.9Affected
before 5.9Not affected
5.10.227 through 5.10.*Not affected
5.15.168 through 5.15.*Not affected
6.1.113 through 6.1.*Not affected
6.6.55 through 6.6.*Not affected
6.10.14 through 6.10.*Not affected
6.11.3 through 6.11.*Not affected
6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.