{"id":"CVE-2024-46811","state":"PUBLISHED","title":"drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box\n\n[Why]\nCoverity reports OVERRUN warning. soc.num_states could\nbe 40. But array range of bw_params->clk_table.entries is 8.\n\n[How]\nAssert if soc.num_states greater than 8.","publishedAt":"2024-09-27T12:35:54.445Z","updatedAt":"2026-10-30T12:19:21.278Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","status":"affected","lessThan":"6d8685dd9718e0613f7c64253500874021b9efc9","versionType":"git"},{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","status":"affected","lessThan":"4003bac784380fed1f94f197350567eaa73a409d","versionType":"git"},{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","status":"affected","lessThan":"aba188d6f4ebaf52acf13f204db2bd2c22072504","versionType":"git"},{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","status":"affected","lessThan":"188fd1616ec43033cedbe343b6579e9921e2d898","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c","drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c","drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c","drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.15","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.50","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.10.9","status":"unaffected","lessThanOrEqual":"6.10.*","versionType":"semver"},{"version":"6.11","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c","drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c","drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c","drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c"]}],"references":["https://git.kernel.org/stable/c/6d8685dd9718e0613f7c64253500874021b9efc9","https://git.kernel.org/stable/c/4003bac784380fed1f94f197350567eaa73a409d","https://git.kernel.org/stable/c/aba188d6f4ebaf52acf13f204db2bd2c22072504","https://git.kernel.org/stable/c/188fd1616ec43033cedbe343b6579e9921e2d898"],"weaknesses":[],"ingestedAt":"2026-10-30T12:36:04.432Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/46xxx/CVE-2024-46811.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-46811","state":"PUBLISHED","datePublished":"2024-09-27T12:35:54.445Z","dateUpdated":"2026-10-30T12:19:21.278Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-09-11T15:12:18.283Z"},"containers":{"cna":{"title":"drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box\n\n[Why]\nCoverity reports OVERRUN warning. soc.num_states could\nbe 40. But array range of bw_params->clk_table.entries is 8.\n\n[How]\nAssert if soc.num_states greater than 8."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","status":"affected","lessThan":"6d8685dd9718e0613f7c64253500874021b9efc9","versionType":"git"},{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","status":"affected","lessThan":"4003bac784380fed1f94f197350567eaa73a409d","versionType":"git"},{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","status":"affected","lessThan":"aba188d6f4ebaf52acf13f204db2bd2c22072504","versionType":"git"},{"version":"4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c","status":"affected","lessThan":"188fd1616ec43033cedbe343b6579e9921e2d898","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c","drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c","drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c","drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.15","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.50","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.10.9","status":"unaffected","lessThanOrEqual":"6.10.*","versionType":"semver"},{"version":"6.11","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/display/dc/dml/dcn302/dcn302_fpu.c","drivers/gpu/drm/amd/display/dc/dml/dcn303/dcn303_fpu.c","drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c","drivers/gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/6d8685dd9718e0613f7c64253500874021b9efc9"},{"url":"https://git.kernel.org/stable/c/4003bac784380fed1f94f197350567eaa73a409d"},{"url":"https://git.kernel.org/stable/c/aba188d6f4ebaf52acf13f204db2bd2c22072504"},{"url":"https://git.kernel.org/stable/c/188fd1616ec43033cedbe343b6579e9921e2d898"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","baseScore":7.3,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only through amdgpu DC initialization paths on the local machine — `dc_construct()`, `dcn32_init_hw()`, and `get_memclk_states_from_smu()` during hardware init and suspend/resume. There is no network, adjacent-network, or physical-device vector.\nAC:L - On affected hardware the overrun happens deterministically whenever the firmware-reported DPM level count plus the hardcoded DCFCLK STA targets exceeds 8 — no race to win, no memory layout to groom, and no unlikely precondition. The vulnerable path in dcn302/dcn303 is entirely ungated.\nPR:L - The trigger points (DC hardware init and resume of the DRM device) are reachable in an ordinary unprivileged desktop session via logind-mediated suspend/resume of the GPU, without root in the init namespace. No pre-authentication or remote path exists, so PR:N is not supportable.\nUI:N - The bounding-box update runs automatically during driver hardware init and resume; no victim action such as opening a file or plugging in a display is required.\nS:U - The out-of-bounds read and the resulting corrupted DML bounding box are both entirely within the kernel's own security authority — there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - With `num_states` able to reach `DC__VOLTAGE_STATES` (40) against an 8-element `entries[]`, the read runs up to ~1.3 KB past the end of the `struct clk_bw_params` allocation into adjacent slab memory — far beyond a \"few bytes\" bounded read. Those bytes are copied into `dml.soc.clock_limits[]`, which feeds userspace-observable clock and mode-validation state.\nI:L - There is no out-of-bounds write — `clock_limits[]` is 40 entries and the index is bounded by that — but attacker-uncontrolled garbage from adjacent memory is written into the DML soc bounding box and then used to program dispclk/dppclk/dcfclk/socclk, corrupting kernel state that drives real display hardware.\nA:H - Reading past the end of the heap-allocated `clk_bw_params` can fault or oops and reliably trips KASAN, and feeding nonsensical clock/voltage limits into DML can hang or blank the display pipeline. Any such kernel crash or hang is High."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:19:21.278Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.6.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.10.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.11"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-29T14:19:04.715171Z","id":"CVE-2024-46811","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-29T14:19:16.904Z"}}]}}}