161 lines
9.0 KiB
JSON
161 lines
9.0 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-21985",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2024-12-29T08:45:45.799Z",
|
|
"datePublished": "2025-04-01T15:47:12.103Z",
|
|
"dateUpdated": "2026-08-05T11:55:51.832Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T11:55:51.832Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix out-of-bound accesses\n\n[WHAT & HOW]\nhpo_stream_to_link_encoder_mapping has size MAX_HPO_DP2_ENCODERS(=4),\nbut location can have size up to 6. As a result, it is necessary to\ncheck location against MAX_HPO_DP2_ENCODERS.\n\nSimiliarly, disp_cfg_stream_location can be used as an array index which\nshould be 0..5, so the ASSERT's conditions should be less without equal."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerable code is reached only through the local DRM atomic modeset ioctl (`DRM_IOCTL_MODE_ATOMIC`) on /dev/dri/card*, via amdgpu_dm_atomic_check() → dc_validate_global_state() → dml2_validate(); no network or remote peer data is involved.\nAC:L - Once a DisplayPort configuration with five or more streams/planes exists (multi-monitor or MST/dock setups, SubVP phantom streams, or primaries plus an MPO overlay), the out-of-bounds index is hit deterministically on every validation pass, and the attacker can re-issue TEST_ONLY atomic commits repeatedly with plane/stream assignments of their choosing.\nPR:L - The atomic ioctl is registered with DRM_MASTER only, which an ordinary unprivileged user holds for their active graphical session on the amdgpu card node — no root, no capability, and no init-namespace privilege is required.\nUI:N - The attacker performs the atomic commit themselves from their own session; no action by any other user is needed to trigger the out-of-bounds access.\nS:U - The corruption is confined to kernel heap memory belonging to the amdgpu display driver within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The read at hpo_stream_to_link_encoder_mapping[4..5] pulls kernel data from beyond the array into adjacent struct state (g6_temp_read_watermark_set), and the resulting out-of-bounds heap write is a corruption primitive that can be leveraged to shape adjacent kernel objects for disclosure.\nI:H - The out-of-bounds value is used directly as an index into the 8-entry OutputEncoder[] array, producing a 4-byte write at a large, configuration-influenced offset that lands outside the kzalloc'd struct dml2_context, corrupting neighbouring heap objects as well as the DML output configuration that drives display hardware programming.\nA:H - The wild write corrupts kernel heap memory and the display-config state used for bandwidth/watermark programming, leading to oops, slab corruption, or hung/underflowing display output requiring recovery."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_translation_helper.c",
|
|
"drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
|
|
"lessThan": "36793d90d76f667d26c6dd025571481ee0c96abc",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
|
|
"lessThan": "9aedc776b11038f04f4641241bb7e877781e4aa4",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
|
|
"lessThan": "8adbb2a98b00926315fd513b5fe2596b5716b82d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_translation_helper.c",
|
|
"drivers/gpu/drm/amd/display/dc/dml2/dml2_translation_helper.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4.15",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "4.15",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.20",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.13.8",
|
|
"lessThanOrEqual": "6.13.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.14",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.15",
|
|
"versionEndExcluding": "6.12.20"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.15",
|
|
"versionEndExcluding": "6.13.8"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.15",
|
|
"versionEndExcluding": "6.14"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/36793d90d76f667d26c6dd025571481ee0c96abc"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/9aedc776b11038f04f4641241bb7e877781e4aa4"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/8adbb2a98b00926315fd513b5fe2596b5716b82d"
|
|
}
|
|
],
|
|
"title": "drm/amd/display: Fix out-of-bound accesses",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |