CVE-2024-49894

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-49894
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49894.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-49894
Downstream
Related
Published
2024-10-21T18:01:28.360Z
Modified
2026-05-30T03:54:37.109289685Z
Summary
drm/amd/display: Fix index out of bounds in degamma hardware format translation
Details

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix index out of bounds in degamma hardware format translation

Fixes index out of bounds issue in cm_helper_translate_curve_to_degamma_hw_format function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFERFUNCPOINTS).

The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds the function returns false to indicate an error.

Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10cmcommon.c:594 cmhelpertranslatecurvetodegammahwformat() error: buffer overflow 'outputtf->tfpts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10cmcommon.c:595 cmhelpertranslatecurvetodegammahwformat() error: buffer overflow 'outputtf->tfpts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10cmcommon.c:596 cmhelpertranslatecurvetodegammahwformat() error: buffer overflow 'outputtf->tf_pts.blue' 1025 <= s32max

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49894.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c
Fixed
b3dfa878257a7e98830b3009ca5831a01d8f85fc
Fixed
f5f6d90087131812c1e4b9d3103f400f1624396d
Fixed
c130a3c09e3746c1a09ce26c20d21d449d039b1d
Fixed
c6979719012a90e5b8e3bc31725fbfdd0b9b2b79
Fixed
2495c8e272d84685403506833a664fad932e453a
Fixed
122e3a7a8c7bcbe3aacddd6103f67f9f36bed473
Fixed
2f5da549535be8ccd2ab7c9abac8562ad370b181
Fixed
07078fa5d589a7fbce8f81ea8acf7aa0021ab38e
Fixed
b7e99058eb2e86aabd7a10761e76cae33d22b49f

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49894.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.15.0
Fixed
4.19.323
Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.4.285
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.227
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.168
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.113
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.55
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.10.14
Type
ECOSYSTEM
Events
Introduced
6.11.0
Fixed
6.11.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49894.json"