Description
In the Linux kernel, the following vulnerability has been resolved: drm: nv04: Fix out of bounds access When Output Resource (dcb->or) value is assigned in fabricate_dcb_output(), there may be out of bounds access to dac_users array in case dcb->or is zero because ffs(dcb->or) is used as index there. The 'or' argument of fabricate_dcb_output() must be interpreted as a number of bit to set, not value. Utilize macros from 'enum nouveau_or' in calls instead of hardcoding. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
2e5702aff39532662198459726c624d5eadbdd78 to < c2b97f26f081ceec3298151481687071075a25cbaffected2e5702aff39532662198459726c624d5eadbdd78 to < 5050ae879a828d752b439e3827aac126709da6d1affected2e5702aff39532662198459726c624d5eadbdd78 to < 097c7918fcfa1dee233acfd1f3029f00c3bc8062affected2e5702aff39532662198459726c624d5eadbdd78 to < df0991da7db846f7fa4ec6740350f743d3b69b04affected2e5702aff39532662198459726c624d5eadbdd78 to < 5fd4b090304e450aa0e7cc9cc2b4873285c6faceaffected2e5702aff39532662198459726c624d5eadbdd78 to < 6690cc2732e2a8d0eaca44dcbac032a4b0148042affected2e5702aff39532662198459726c624d5eadbdd78 to < 26212da39ee14a52c76a202c6ae5153a84f579a5affected2e5702aff39532662198459726c624d5eadbdd78 to < cf92bb778eda7830e79452c6917efa8474a30c1eaffected
Linux Linux
Default version status: affected
2.6.38affected0 to < 2.6.38unaffected4.19.313 to ≤ 4.19.*unaffected5.4.275 to ≤ 5.4.*unaffected5.10.216 to ≤ 5.10.*unaffected5.15.157 to ≤ 5.15.*unaffected6.1.88 to ≤ 6.1.*unaffected6.6.29 to ≤ 6.6.*unaffected6.8.8 to ≤ 6.8.*unaffected6.9 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c2b97f26f081ceec3298151481687071075a25cb ↗
- https://git.kernel.org/stable/c/5050ae879a828d752b439e3827aac126709da6d1 ↗
- https://git.kernel.org/stable/c/097c7918fcfa1dee233acfd1f3029f00c3bc8062 ↗
- https://git.kernel.org/stable/c/df0991da7db846f7fa4ec6740350f743d3b69b04 ↗
- https://git.kernel.org/stable/c/5fd4b090304e450aa0e7cc9cc2b4873285c6face ↗
- https://git.kernel.org/stable/c/6690cc2732e2a8d0eaca44dcbac032a4b0148042 ↗
- https://git.kernel.org/stable/c/26212da39ee14a52c76a202c6ae5153a84f579a5 ↗
- https://git.kernel.org/stable/c/cf92bb778eda7830e79452c6917efa8474a30c1e ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/ ↗