CVE-2024-49969

drm/amd/display: Fix index out of bounds in DCN30 color transformation

HIGH
7.8
CVSS Score
Published: October 21, 2024 at 06:02 PM UTC
Updated: August 5, 2026 at 12:05 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.8
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in DCN30 color transformation This commit addresses a potential index out of bounds issue in the `cm3_helper_translate_curve_to_hw_format` function in the DCN30 color management module. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS). The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds, the function returns false to indicate an error. drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:180 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:181 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:182 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v < 5.10.2275.11 ≤ v < 5.15.1685.16 ≤ v < 6.1.1135.9 ≤ v < 5.10.2275.9 ≤ v < 5.15.1685.9 ≤ v < 6.1.1135.9 ≤ v < 6.10.145.9 ≤ v < 6.11.35.9 ≤ v < 6.125.9 ≤ v < 6.6.556.11 ≤ v < 6.11.36.2 ≤ v < 6.6.556.7 ≤ v < 6.10.143f54d7d3448dc1668568d1adb69b43c1d1dc79f5.9
Vendor states this is fixed in 0f1e222a4b41d77c442901d166fbdca967af0d86 (fixed)
Vendor states this is fixed in 578422ddae3d13362b64e77ef9bab98780641631 (fixed)
Vendor states this is fixed in 7ab69af56a23859b647dee69fa1052c689343621 (fixed)
Vendor states this is fixed in 929506d5671419cffd8d01e9a7f5eae53682a838 (fixed)
Vendor states this is fixed in b9d8b94ec7e67f0cae228c054f77b73967c389a3 (fixed)
Vendor states this is fixed in c13f9c62015c56a938304cef6d507227ea3e0039 (fixed)
Vendor states this is fixed in d81873f9e715b72d4f8d391c8eb243946f784dfc (fixed)
Vendor states this is fixed in 5.10.227 (unaffected)
Vendor states this is fixed in 5.15.168 (unaffected)
Vendor states this is fixed in 5.9 (unaffected)
Vendor states this is fixed in 6.1.113 (unaffected)
Vendor states this is fixed in 6.10.14 (unaffected)
Vendor states this is fixed in 6.11.3 (unaffected)
Vendor states this is fixed in 6.12 (unaffected)
Vendor states this is fixed in 6.6.55 (unaffected)

References (9)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/0f1e222a4b41d77c442901d166fbdca967af0d86
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/578422ddae3d13362b64e77ef9bab98780641631
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7ab69af56a23859b647dee69fa1052c689343621
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/929506d5671419cffd8d01e9a7f5eae53682a838
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b9d8b94ec7e67f0cae228c054f77b73967c389a3
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c13f9c62015c56a938304cef6d507227ea3e0039
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d81873f9e715b72d4f8d391c8eb243946f784dfc
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-129

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card