CVE-2024-38552

drm/amd/display: Fix potential index out of bounds in color transformation function

HIGH
7.8
CVSS Score
Published: June 19, 2024 at 01:35 PM UTC
Updated: October 15, 2026 at 01:18 AM UTC
2 products affected across 2 vendorsLinux KernelSIMATIC S7-1500 TM MFP

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential index out of bounds in color transformation function Fixes index out of bounds issue in the color transformation function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS). The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds, an error message is logged and the function returns false to indicate an error. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

All versions4.16 ≤ v < 4.19.3164.20 ≤ v < 5.4.2785.11 ≤ v < 5.15.1615.16 ≤ v < 6.1.935.5 ≤ v < 5.10.2196.2 ≤ v < 6.6.336.7 ≤ v < 6.8.126.9 ≤ v < 6.9.34.16b629596072e5fa901c84f9e88d845a696ee32942
Vendor states this is fixed in 04bc4d1090c343025d69149ca669a27c5b9c34a7 (fixed)
Vendor states this is fixed in 123edbae64f4d21984359b99c6e79fcde31c6123 (fixed)
Vendor states this is fixed in 4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86 (fixed)
Vendor states this is fixed in 604c506ca43fce52bb882cff9c1fdf2ec3b4029c (fixed)
Vendor states this is fixed in 63ae548f1054a0b71678d0349c7dc9628ddd42ca (fixed)
Vendor states this is fixed in 7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29 (fixed)
Vendor states this is fixed in 98b8a6bfd30d07a19cfacdf82b50f84bf3360869 (fixed)
Vendor states this is fixed in ced9c4e2289a786b8fa684d8893b7045ea53ef7e (fixed)
Vendor states this is fixed in e280ab978c81443103d7c61bdd1d8d708cf6ed6d (fixed)
Vendor states this is fixed in 4.16 (unaffected)
Vendor states this is fixed in 4.19.316 (unaffected)
Vendor states this is fixed in 5.10.219 (unaffected)
Vendor states this is fixed in 5.15.161 (unaffected)
Vendor states this is fixed in 5.4.278 (unaffected)
Vendor states this is fixed in 6.1.93 (unaffected)
Vendor states this is fixed in 6.10 (unaffected)
Vendor states this is fixed in 6.6.33 (unaffected)
Vendor states this is fixed in 6.8.12 (unaffected)
Vendor states this is fixed in 6.9.3 (unaffected)

References (11)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/04bc4d1090c343025d69149ca669a27c5b9c34a7
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/604c506ca43fce52bb882cff9c1fdf2ec3b4029c
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/63ae548f1054a0b71678d0349c7dc9628ddd42ca
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/98b8a6bfd30d07a19cfacdf82b50f84bf3360869
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ced9c4e2289a786b8fa684d8893b7045ea53ef7e

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-129

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card