Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use krealloc_array() in dal_vector_reserve() [Why & How] dal_vector_reserve() computes the allocation size as "capacity * vector->struct_size" using uint32_t arithmetic, which can silently wrap to a small value on overflow. This would cause krealloc to return a smaller buffer than expected, leading to heap overflows on subsequent vector appends. Replace krealloc() with krealloc_array() which performs an internal overflow check and returns NULL on wrap, preventing the issue. (cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
2004f45ef83f07f43f5da6ede780b08068c7583d to < 9540b0a4d13e4ede64ae1197d66a176d2149daa9affected2004f45ef83f07f43f5da6ede780b08068c7583d to < 31180638a33acad12c863132704a76536fb66211affected2004f45ef83f07f43f5da6ede780b08068c7583d to < b15825deac1acff72638bbc8f05b89ceef8dfb13affected2004f45ef83f07f43f5da6ede780b08068c7583d to < 201151e120f0062bcda21cad5d007b82725ad23baffected2004f45ef83f07f43f5da6ede780b08068c7583d to < a914aa802669e073f014dae2e5708633b5cecd34affected2004f45ef83f07f43f5da6ede780b08068c7583d to < e09689286385a66311ac6922af95339d7a3cef8daffected2004f45ef83f07f43f5da6ede780b08068c7583d to < de988c7a31f0774f07894cfe4802996f318e2870affected2004f45ef83f07f43f5da6ede780b08068c7583d to < da48bc4461b8a5ebfb9264c9b191a701d8e99009affected
Linux Linux
Default version status: affected
4.15affected0 to < 4.15unaffected5.10.260 to ≤ 5.10.*unaffected5.15.210 to ≤ 5.15.*unaffected6.1.176 to ≤ 6.1.*unaffected6.6.143 to ≤ 6.6.*unaffected6.12.94 to ≤ 6.12.*unaffected6.18.36 to ≤ 6.18.*unaffected7.0.13 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/9540b0a4d13e4ede64ae1197d66a176d2149daa9 ↗
- https://git.kernel.org/stable/c/31180638a33acad12c863132704a76536fb66211 ↗
- https://git.kernel.org/stable/c/b15825deac1acff72638bbc8f05b89ceef8dfb13 ↗
- https://git.kernel.org/stable/c/201151e120f0062bcda21cad5d007b82725ad23b ↗
- https://git.kernel.org/stable/c/a914aa802669e073f014dae2e5708633b5cecd34 ↗
- https://git.kernel.org/stable/c/e09689286385a66311ac6922af95339d7a3cef8d ↗
- https://git.kernel.org/stable/c/de988c7a31f0774f07894cfe4802996f318e2870 ↗
- https://git.kernel.org/stable/c/da48bc4461b8a5ebfb9264c9b191a701d8e99009 ↗