CVE-2024-50177 (GCVE-0-2024-50177)

Vulnerability from cvelistv5 – Published: 2024-11-08 05:23 – Updated: 2026-05-11 20:46
VLAI
Title
drm/amd/display: fix a UBSAN warning in DML2.1
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix a UBSAN warning in DML2.1 When programming phantom pipe, since cursor_width is explicity set to 0, this causes calculation logic to trigger overflow for an unsigned int triggering the kernel's UBSAN check as below: [ 40.962845] UBSAN: shift-out-of-bounds in /tmp/amd.EfpumTkO/amd/amdgpu/../display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c:3312:34 [ 40.962849] shift exponent 4294967170 is too large for 32-bit type 'unsigned int' [ 40.962852] CPU: 1 PID: 1670 Comm: gnome-shell Tainted: G W OE 6.5.0-41-generic #41~22.04.2-Ubuntu [ 40.962854] Hardware name: Gigabyte Technology Co., Ltd. X670E AORUS PRO X/X670E AORUS PRO X, BIOS F21 01/10/2024 [ 40.962856] Call Trace: [ 40.962857] <TASK> [ 40.962860] dump_stack_lvl+0x48/0x70 [ 40.962870] dump_stack+0x10/0x20 [ 40.962872] __ubsan_handle_shift_out_of_bounds+0x1ac/0x360 [ 40.962878] calculate_cursor_req_attributes.cold+0x1b/0x28 [amdgpu] [ 40.963099] dml_core_mode_support+0x6b91/0x16bc0 [amdgpu] [ 40.963327] ? srso_alias_return_thunk+0x5/0x7f [ 40.963331] ? CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport+0x18b8/0x2790 [amdgpu] [ 40.963534] ? srso_alias_return_thunk+0x5/0x7f [ 40.963536] ? dml_core_mode_support+0xb3db/0x16bc0 [amdgpu] [ 40.963730] dml2_core_calcs_mode_support_ex+0x2c/0x90 [amdgpu] [ 40.963906] ? srso_alias_return_thunk+0x5/0x7f [ 40.963909] ? dml2_core_calcs_mode_support_ex+0x2c/0x90 [amdgpu] [ 40.964078] core_dcn4_mode_support+0x72/0xbf0 [amdgpu] [ 40.964247] dml2_top_optimization_perform_optimization_phase+0x1d3/0x2a0 [amdgpu] [ 40.964420] dml2_build_mode_programming+0x23d/0x750 [amdgpu] [ 40.964587] dml21_validate+0x274/0x770 [amdgpu] [ 40.964761] ? srso_alias_return_thunk+0x5/0x7f [ 40.964763] ? resource_append_dpp_pipes_for_plane_composition+0x27c/0x3b0 [amdgpu] [ 40.964942] dml2_validate+0x504/0x750 [amdgpu] [ 40.965117] ? dml21_copy+0x95/0xb0 [amdgpu] [ 40.965291] ? srso_alias_return_thunk+0x5/0x7f [ 40.965295] dcn401_validate_bandwidth+0x4e/0x70 [amdgpu] [ 40.965491] update_planes_and_stream_state+0x38d/0x5c0 [amdgpu] [ 40.965672] update_planes_and_stream_v3+0x52/0x1e0 [amdgpu] [ 40.965845] ? srso_alias_return_thunk+0x5/0x7f [ 40.965849] dc_update_planes_and_stream+0x71/0xb0 [amdgpu] Fix this by adding a guard for checking cursor width before triggering the size calculation.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-190 - Integer Overflow or Wraparound
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 70839da6360500a82e4d5f78499284474cbed7c1 , < 27bc3da5eae57e3af8f5648b4498ffde48781434 (git)
Affected: 70839da6360500a82e4d5f78499284474cbed7c1 , < eaf3adb8faab611ba57594fa915893fc93a7788c (git)
Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.11.3 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50177",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:19:12.163873Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:27:10.217Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "27bc3da5eae57e3af8f5648b4498ffde48781434",
              "status": "affected",
              "version": "70839da6360500a82e4d5f78499284474cbed7c1",
              "versionType": "git"
            },
            {
              "lessThan": "eaf3adb8faab611ba57594fa915893fc93a7788c",
              "status": "affected",
              "version": "70839da6360500a82e4d5f78499284474cbed7c1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix a UBSAN warning in DML2.1\n\nWhen programming phantom pipe, since cursor_width is explicity set to 0,\nthis causes calculation logic to trigger overflow for an unsigned int\ntriggering the kernel\u0027s UBSAN check as below:\n\n[   40.962845] UBSAN: shift-out-of-bounds in /tmp/amd.EfpumTkO/amd/amdgpu/../display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c:3312:34\n[   40.962849] shift exponent 4294967170 is too large for 32-bit type \u0027unsigned int\u0027\n[   40.962852] CPU: 1 PID: 1670 Comm: gnome-shell Tainted: G        W  OE      6.5.0-41-generic #41~22.04.2-Ubuntu\n[   40.962854] Hardware name: Gigabyte Technology Co., Ltd. X670E AORUS PRO X/X670E AORUS PRO X, BIOS F21 01/10/2024\n[   40.962856] Call Trace:\n[   40.962857]  \u003cTASK\u003e\n[   40.962860]  dump_stack_lvl+0x48/0x70\n[   40.962870]  dump_stack+0x10/0x20\n[   40.962872]  __ubsan_handle_shift_out_of_bounds+0x1ac/0x360\n[   40.962878]  calculate_cursor_req_attributes.cold+0x1b/0x28 [amdgpu]\n[   40.963099]  dml_core_mode_support+0x6b91/0x16bc0 [amdgpu]\n[   40.963327]  ? srso_alias_return_thunk+0x5/0x7f\n[   40.963331]  ? CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport+0x18b8/0x2790 [amdgpu]\n[   40.963534]  ? srso_alias_return_thunk+0x5/0x7f\n[   40.963536]  ? dml_core_mode_support+0xb3db/0x16bc0 [amdgpu]\n[   40.963730]  dml2_core_calcs_mode_support_ex+0x2c/0x90 [amdgpu]\n[   40.963906]  ? srso_alias_return_thunk+0x5/0x7f\n[   40.963909]  ? dml2_core_calcs_mode_support_ex+0x2c/0x90 [amdgpu]\n[   40.964078]  core_dcn4_mode_support+0x72/0xbf0 [amdgpu]\n[   40.964247]  dml2_top_optimization_perform_optimization_phase+0x1d3/0x2a0 [amdgpu]\n[   40.964420]  dml2_build_mode_programming+0x23d/0x750 [amdgpu]\n[   40.964587]  dml21_validate+0x274/0x770 [amdgpu]\n[   40.964761]  ? srso_alias_return_thunk+0x5/0x7f\n[   40.964763]  ? resource_append_dpp_pipes_for_plane_composition+0x27c/0x3b0 [amdgpu]\n[   40.964942]  dml2_validate+0x504/0x750 [amdgpu]\n[   40.965117]  ? dml21_copy+0x95/0xb0 [amdgpu]\n[   40.965291]  ? srso_alias_return_thunk+0x5/0x7f\n[   40.965295]  dcn401_validate_bandwidth+0x4e/0x70 [amdgpu]\n[   40.965491]  update_planes_and_stream_state+0x38d/0x5c0 [amdgpu]\n[   40.965672]  update_planes_and_stream_v3+0x52/0x1e0 [amdgpu]\n[   40.965845]  ? srso_alias_return_thunk+0x5/0x7f\n[   40.965849]  dc_update_planes_and_stream+0x71/0xb0 [amdgpu]\n\nFix this by adding a guard for checking cursor width before triggering\nthe size calculation."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:46:55.902Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/27bc3da5eae57e3af8f5648b4498ffde48781434"
        },
        {
          "url": "https://git.kernel.org/stable/c/eaf3adb8faab611ba57594fa915893fc93a7788c"
        }
      ],
      "title": "drm/amd/display: fix a UBSAN warning in DML2.1",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50177",
    "datePublished": "2024-11-08T05:23:59.205Z",
    "dateReserved": "2024-10-21T19:36:19.964Z",
    "dateUpdated": "2026-05-11T20:46:55.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50177",
      "date": "2026-06-12",
      "epss": "0.00017",
      "percentile": "0.04123"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.11.3\", \"matchCriteriaId\": \"6D5FF9C2-A011-4A64-B614-F9244ED2EA0D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: fix a UBSAN warning in DML2.1\\n\\nWhen programming phantom pipe, since cursor_width is explicity set to 0,\\nthis causes calculation logic to trigger overflow for an unsigned int\\ntriggering the kernel\u0027s UBSAN check as below:\\n\\n[   40.962845] UBSAN: shift-out-of-bounds in /tmp/amd.EfpumTkO/amd/amdgpu/../display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c:3312:34\\n[   40.962849] shift exponent 4294967170 is too large for 32-bit type \u0027unsigned int\u0027\\n[   40.962852] CPU: 1 PID: 1670 Comm: gnome-shell Tainted: G        W  OE      6.5.0-41-generic #41~22.04.2-Ubuntu\\n[   40.962854] Hardware name: Gigabyte Technology Co., Ltd. X670E AORUS PRO X/X670E AORUS PRO X, BIOS F21 01/10/2024\\n[   40.962856] Call Trace:\\n[   40.962857]  \u003cTASK\u003e\\n[   40.962860]  dump_stack_lvl+0x48/0x70\\n[   40.962870]  dump_stack+0x10/0x20\\n[   40.962872]  __ubsan_handle_shift_out_of_bounds+0x1ac/0x360\\n[   40.962878]  calculate_cursor_req_attributes.cold+0x1b/0x28 [amdgpu]\\n[   40.963099]  dml_core_mode_support+0x6b91/0x16bc0 [amdgpu]\\n[   40.963327]  ? srso_alias_return_thunk+0x5/0x7f\\n[   40.963331]  ? CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport+0x18b8/0x2790 [amdgpu]\\n[   40.963534]  ? srso_alias_return_thunk+0x5/0x7f\\n[   40.963536]  ? dml_core_mode_support+0xb3db/0x16bc0 [amdgpu]\\n[   40.963730]  dml2_core_calcs_mode_support_ex+0x2c/0x90 [amdgpu]\\n[   40.963906]  ? srso_alias_return_thunk+0x5/0x7f\\n[   40.963909]  ? dml2_core_calcs_mode_support_ex+0x2c/0x90 [amdgpu]\\n[   40.964078]  core_dcn4_mode_support+0x72/0xbf0 [amdgpu]\\n[   40.964247]  dml2_top_optimization_perform_optimization_phase+0x1d3/0x2a0 [amdgpu]\\n[   40.964420]  dml2_build_mode_programming+0x23d/0x750 [amdgpu]\\n[   40.964587]  dml21_validate+0x274/0x770 [amdgpu]\\n[   40.964761]  ? srso_alias_return_thunk+0x5/0x7f\\n[   40.964763]  ? resource_append_dpp_pipes_for_plane_composition+0x27c/0x3b0 [amdgpu]\\n[   40.964942]  dml2_validate+0x504/0x750 [amdgpu]\\n[   40.965117]  ? dml21_copy+0x95/0xb0 [amdgpu]\\n[   40.965291]  ? srso_alias_return_thunk+0x5/0x7f\\n[   40.965295]  dcn401_validate_bandwidth+0x4e/0x70 [amdgpu]\\n[   40.965491]  update_planes_and_stream_state+0x38d/0x5c0 [amdgpu]\\n[   40.965672]  update_planes_and_stream_v3+0x52/0x1e0 [amdgpu]\\n[   40.965845]  ? srso_alias_return_thunk+0x5/0x7f\\n[   40.965849]  dc_update_planes_and_stream+0x71/0xb0 [amdgpu]\\n\\nFix this by adding a guard for checking cursor width before triggering\\nthe size calculation.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/display: se corrige una advertencia de UBSAN en DML2.1 Al programar una tuber\\u00eda fantasma, dado que cursor_width se establece expl\\u00edcitamente en 0, esto hace que la l\\u00f3gica de c\\u00e1lculo active un desbordamiento para un int sin signo que activa la comprobaci\\u00f3n UBSAN del kernel como se muestra a continuaci\\u00f3n: [ 40.962845] UBSAN: desplazamiento fuera de los l\\u00edmites en /tmp/amd.EfpumTkO/amd/amdgpu/../display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c:3312:34 [ 40.962849] El exponente de desplazamiento 4294967170 es demasiado grande para el tipo de 32 bits \u0027unsigned int\u0027 [ 40.962852] CPU: 1 PID: 1670 Comm: gnome-shell Contaminado: GW OE 6.5.0-41-generic #41~22.04.2-Ubuntu [ 40.962854] Nombre del hardware: Gigabyte Technology Co., Ltd. X670E AORUS PRO X/X670E AORUS PRO X, BIOS F21 01/10/2024 [ 40.962856] Seguimiento de llamadas: [ 40.962857]  [ 40.962860] dump_stack_lvl+0x48/0x70 [ 40.962870] dump_stack+0x10/0x20 [ 40.962872] __ubsan_handle_shift_out_of_bounds+0x1ac/0x360 [ 40.962878] CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport+0x18b8/0x2790 [amdgpu] [ 40.963534] ? srso_alias_return_thunk+0x5/0x7f [ 40.963536] ? srso_alias_return_thunk+0x5/0x7f [ 40.963909] ? srso_alias_return_thunk+0x5/0x7f [ 40.964763] ? recurso_agregar_dpp_tuber\\u00edas_para_composici\\u00f3n_de_planos+0x27c/0x3b0 [amdgpu] [ 40.964942] dml2_validate+0x504/0x750 [amdgpu] [ 40.965117] ? dml21_copy+0x95/0xb0 [amdgpu] [ 40.965291] ? srso_alias_return_thunk+0x5/0x7f [ 40.965295] dcn401_validate_bandwidth+0x4e/0x70 [amdgpu] [ 40.965491] update_planes_and_stream_state+0x38d/0x5c0 [amdgpu] [ 40.965672] update_planes_and_stream_v3+0x52/0x1e0 [amdgpu] [ 40.965845] ? srso_alias_return_thunk+0x5/0x7f [ 40.965849] dc_update_planes_and_stream+0x71/0xb0 [amdgpu] Solucione esto agregando una protecci\\u00f3n para verificar el ancho del cursor antes de activar el c\\u00e1lculo del tama\\u00f1o.\"}]",
      "id": "CVE-2024-50177",
      "lastModified": "2024-12-09T23:14:39.593",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-11-08T06:15:15.117",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/27bc3da5eae57e3af8f5648b4498ffde48781434\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/eaf3adb8faab611ba57594fa915893fc93a7788c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-190\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50177\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-08T06:15:15.117\",\"lastModified\":\"2025-10-01T21:15:58.780\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: fix a UBSAN warning in DML2.1\\n\\nWhen programming phantom pipe, since cursor_width is explicity set to 0,\\nthis causes calculation logic to trigger overflow for an unsigned int\\ntriggering the kernel\u0027s UBSAN check as below:\\n\\n[   40.962845] UBSAN: shift-out-of-bounds in /tmp/amd.EfpumTkO/amd/amdgpu/../display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c:3312:34\\n[   40.962849] shift exponent 4294967170 is too large for 32-bit type \u0027unsigned int\u0027\\n[   40.962852] CPU: 1 PID: 1670 Comm: gnome-shell Tainted: G        W  OE      6.5.0-41-generic #41~22.04.2-Ubuntu\\n[   40.962854] Hardware name: Gigabyte Technology Co., Ltd. X670E AORUS PRO X/X670E AORUS PRO X, BIOS F21 01/10/2024\\n[   40.962856] Call Trace:\\n[   40.962857]  \u003cTASK\u003e\\n[   40.962860]  dump_stack_lvl+0x48/0x70\\n[   40.962870]  dump_stack+0x10/0x20\\n[   40.962872]  __ubsan_handle_shift_out_of_bounds+0x1ac/0x360\\n[   40.962878]  calculate_cursor_req_attributes.cold+0x1b/0x28 [amdgpu]\\n[   40.963099]  dml_core_mode_support+0x6b91/0x16bc0 [amdgpu]\\n[   40.963327]  ? srso_alias_return_thunk+0x5/0x7f\\n[   40.963331]  ? CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport+0x18b8/0x2790 [amdgpu]\\n[   40.963534]  ? srso_alias_return_thunk+0x5/0x7f\\n[   40.963536]  ? dml_core_mode_support+0xb3db/0x16bc0 [amdgpu]\\n[   40.963730]  dml2_core_calcs_mode_support_ex+0x2c/0x90 [amdgpu]\\n[   40.963906]  ? srso_alias_return_thunk+0x5/0x7f\\n[   40.963909]  ? dml2_core_calcs_mode_support_ex+0x2c/0x90 [amdgpu]\\n[   40.964078]  core_dcn4_mode_support+0x72/0xbf0 [amdgpu]\\n[   40.964247]  dml2_top_optimization_perform_optimization_phase+0x1d3/0x2a0 [amdgpu]\\n[   40.964420]  dml2_build_mode_programming+0x23d/0x750 [amdgpu]\\n[   40.964587]  dml21_validate+0x274/0x770 [amdgpu]\\n[   40.964761]  ? srso_alias_return_thunk+0x5/0x7f\\n[   40.964763]  ? resource_append_dpp_pipes_for_plane_composition+0x27c/0x3b0 [amdgpu]\\n[   40.964942]  dml2_validate+0x504/0x750 [amdgpu]\\n[   40.965117]  ? dml21_copy+0x95/0xb0 [amdgpu]\\n[   40.965291]  ? srso_alias_return_thunk+0x5/0x7f\\n[   40.965295]  dcn401_validate_bandwidth+0x4e/0x70 [amdgpu]\\n[   40.965491]  update_planes_and_stream_state+0x38d/0x5c0 [amdgpu]\\n[   40.965672]  update_planes_and_stream_v3+0x52/0x1e0 [amdgpu]\\n[   40.965845]  ? srso_alias_return_thunk+0x5/0x7f\\n[   40.965849]  dc_update_planes_and_stream+0x71/0xb0 [amdgpu]\\n\\nFix this by adding a guard for checking cursor width before triggering\\nthe size calculation.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/display: se corrige una advertencia de UBSAN en DML2.1 Al programar una tuber\u00eda fantasma, dado que cursor_width se establece expl\u00edcitamente en 0, esto hace que la l\u00f3gica de c\u00e1lculo active un desbordamiento para un int sin signo que activa la comprobaci\u00f3n UBSAN del kernel como se muestra a continuaci\u00f3n: [ 40.962845] UBSAN: desplazamiento fuera de los l\u00edmites en /tmp/amd.EfpumTkO/amd/amdgpu/../display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c:3312:34 [ 40.962849] El exponente de desplazamiento 4294967170 es demasiado grande para el tipo de 32 bits \u0027unsigned int\u0027 [ 40.962852] CPU: 1 PID: 1670 Comm: gnome-shell Contaminado: GW OE 6.5.0-41-generic #41~22.04.2-Ubuntu [ 40.962854] Nombre del hardware: Gigabyte Technology Co., Ltd. X670E AORUS PRO X/X670E AORUS PRO X, BIOS F21 01/10/2024 [ 40.962856] Seguimiento de llamadas: [ 40.962857]  [ 40.962860] dump_stack_lvl+0x48/0x70 [ 40.962870] dump_stack+0x10/0x20 [ 40.962872] __ubsan_handle_shift_out_of_bounds+0x1ac/0x360 [ 40.962878] CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport+0x18b8/0x2790 [amdgpu] [ 40.963534] ? srso_alias_return_thunk+0x5/0x7f [ 40.963536] ? srso_alias_return_thunk+0x5/0x7f [ 40.963909] ? srso_alias_return_thunk+0x5/0x7f [ 40.964763] ? recurso_agregar_dpp_tuber\u00edas_para_composici\u00f3n_de_planos+0x27c/0x3b0 [amdgpu] [ 40.964942] dml2_validate+0x504/0x750 [amdgpu] [ 40.965117] ? dml21_copy+0x95/0xb0 [amdgpu] [ 40.965291] ? srso_alias_return_thunk+0x5/0x7f [ 40.965295] dcn401_validate_bandwidth+0x4e/0x70 [amdgpu] [ 40.965491] update_planes_and_stream_state+0x38d/0x5c0 [amdgpu] [ 40.965672] update_planes_and_stream_v3+0x52/0x1e0 [amdgpu] [ 40.965845] ? srso_alias_return_thunk+0x5/0x7f [ 40.965849] dc_update_planes_and_stream+0x71/0xb0 [amdgpu] Solucione esto agregando una protecci\u00f3n para verificar el ancho del cursor antes de activar el c\u00e1lculo del tama\u00f1o.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.11.3\",\"matchCriteriaId\":\"6D5FF9C2-A011-4A64-B614-F9244ED2EA0D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/27bc3da5eae57e3af8f5648b4498ffde48781434\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/eaf3adb8faab611ba57594fa915893fc93a7788c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50177\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:19:12.163873Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-190\", \"description\": \"CWE-190 Integer Overflow or Wraparound\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:19:51.774Z\"}}], \"cna\": {\"title\": \"drm/amd/display: fix a UBSAN warning in DML2.1\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"70839da6360500a82e4d5f78499284474cbed7c1\", \"lessThan\": \"27bc3da5eae57e3af8f5648b4498ffde48781434\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"70839da6360500a82e4d5f78499284474cbed7c1\", \"lessThan\": \"eaf3adb8faab611ba57594fa915893fc93a7788c\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/27bc3da5eae57e3af8f5648b4498ffde48781434\"}, {\"url\": \"https://git.kernel.org/stable/c/eaf3adb8faab611ba57594fa915893fc93a7788c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: fix a UBSAN warning in DML2.1\\n\\nWhen programming phantom pipe, since cursor_width is explicity set to 0,\\nthis causes calculation logic to trigger overflow for an unsigned int\\ntriggering the kernel\u0027s UBSAN check as below:\\n\\n[   40.962845] UBSAN: shift-out-of-bounds in /tmp/amd.EfpumTkO/amd/amdgpu/../display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c:3312:34\\n[   40.962849] shift exponent 4294967170 is too large for 32-bit type \u0027unsigned int\u0027\\n[   40.962852] CPU: 1 PID: 1670 Comm: gnome-shell Tainted: G        W  OE      6.5.0-41-generic #41~22.04.2-Ubuntu\\n[   40.962854] Hardware name: Gigabyte Technology Co., Ltd. X670E AORUS PRO X/X670E AORUS PRO X, BIOS F21 01/10/2024\\n[   40.962856] Call Trace:\\n[   40.962857]  \u003cTASK\u003e\\n[   40.962860]  dump_stack_lvl+0x48/0x70\\n[   40.962870]  dump_stack+0x10/0x20\\n[   40.962872]  __ubsan_handle_shift_out_of_bounds+0x1ac/0x360\\n[   40.962878]  calculate_cursor_req_attributes.cold+0x1b/0x28 [amdgpu]\\n[   40.963099]  dml_core_mode_support+0x6b91/0x16bc0 [amdgpu]\\n[   40.963327]  ? srso_alias_return_thunk+0x5/0x7f\\n[   40.963331]  ? CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport+0x18b8/0x2790 [amdgpu]\\n[   40.963534]  ? srso_alias_return_thunk+0x5/0x7f\\n[   40.963536]  ? dml_core_mode_support+0xb3db/0x16bc0 [amdgpu]\\n[   40.963730]  dml2_core_calcs_mode_support_ex+0x2c/0x90 [amdgpu]\\n[   40.963906]  ? srso_alias_return_thunk+0x5/0x7f\\n[   40.963909]  ? dml2_core_calcs_mode_support_ex+0x2c/0x90 [amdgpu]\\n[   40.964078]  core_dcn4_mode_support+0x72/0xbf0 [amdgpu]\\n[   40.964247]  dml2_top_optimization_perform_optimization_phase+0x1d3/0x2a0 [amdgpu]\\n[   40.964420]  dml2_build_mode_programming+0x23d/0x750 [amdgpu]\\n[   40.964587]  dml21_validate+0x274/0x770 [amdgpu]\\n[   40.964761]  ? srso_alias_return_thunk+0x5/0x7f\\n[   40.964763]  ? resource_append_dpp_pipes_for_plane_composition+0x27c/0x3b0 [amdgpu]\\n[   40.964942]  dml2_validate+0x504/0x750 [amdgpu]\\n[   40.965117]  ? dml21_copy+0x95/0xb0 [amdgpu]\\n[   40.965291]  ? srso_alias_return_thunk+0x5/0x7f\\n[   40.965295]  dcn401_validate_bandwidth+0x4e/0x70 [amdgpu]\\n[   40.965491]  update_planes_and_stream_state+0x38d/0x5c0 [amdgpu]\\n[   40.965672]  update_planes_and_stream_v3+0x52/0x1e0 [amdgpu]\\n[   40.965845]  ? srso_alias_return_thunk+0x5/0x7f\\n[   40.965849]  dc_update_planes_and_stream+0x71/0xb0 [amdgpu]\\n\\nFix this by adding a guard for checking cursor width before triggering\\nthe size calculation.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.3\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:47:59.860Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50177\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-01T20:27:10.217Z\", \"dateReserved\": \"2024-10-21T19:36:19.964Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-08T05:23:59.205Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.