cve-2024-26721
Vulnerability from cvelistv5
Published
2024-04-03 14:55
Modified
2024-12-19 08:45
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/i915/dsc: Fix the macro that calculates DSCC_/DSCA_ PPS reg address Commit bd077259d0a9 ("drm/i915/vdsc: Add function to read any PPS register") defines a new macro to calculate the DSC PPS register addresses with PPS number as an input. This macro correctly calculates the addresses till PPS 11 since the addresses increment by 4. So in that case the following macro works correctly to give correct register address: _MMIO(_DSCA_PPS_0 + (pps) * 4) However after PPS 11, the register address for PPS 12 increments by 12 because of RC Buffer memory allocation in between. Because of this discontinuity in the address space, the macro calculates wrong addresses for PPS 12 - 16 resulting into incorrect DSC PPS parameter value read/writes causing DSC corruption. This fixes it by correcting this macro to add the offset of 12 for PPS >=12. v3: Add correct paranthesis for pps argument (Jani Nikula) (cherry picked from commit 6074be620c31dc2ae11af96a1a5ea95580976fb5)
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/962ac2dce56bb3aad1f82a4bbe3ada57a020287c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ff5999fb03f467e1e7159f0ddb199c787f7512b9
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/962ac2dce56bb3aad1f82a4bbe3ada57a020287c
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/ff5999fb03f467e1e7159f0ddb199c787f7512b9
Impacted products
Vendor Product Version
Linux Linux Version: 6.7
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.016Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ff5999fb03f467e1e7159f0ddb199c787f7512b9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/962ac2dce56bb3aad1f82a4bbe3ada57a020287c"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26721",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:52:16.898186Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:32:52.594Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/display/intel_vdsc_regs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ff5999fb03f467e1e7159f0ddb199c787f7512b9",
              "status": "affected",
              "version": "bd077259d0a9c9bf453e7e9751bf41f1996e6585",
              "versionType": "git"
            },
            {
              "lessThan": "962ac2dce56bb3aad1f82a4bbe3ada57a020287c",
              "status": "affected",
              "version": "bd077259d0a9c9bf453e7e9751bf41f1996e6585",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/display/intel_vdsc_regs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/dsc: Fix the macro that calculates DSCC_/DSCA_ PPS reg address\n\nCommit bd077259d0a9 (\"drm/i915/vdsc: Add function to read any PPS\nregister\") defines a new macro to calculate the DSC PPS register\naddresses with PPS number as an input. This macro correctly calculates\nthe addresses till PPS 11 since the addresses increment by 4. So in that\ncase the following macro works correctly to give correct register\naddress:\n\n_MMIO(_DSCA_PPS_0 + (pps) * 4)\n\nHowever after PPS 11, the register address for PPS 12 increments by 12\nbecause of RC Buffer memory allocation in between. Because of this\ndiscontinuity in the address space, the macro calculates wrong addresses\nfor PPS 12 - 16 resulting into incorrect DSC PPS parameter value\nread/writes causing DSC corruption.\n\nThis fixes it by correcting this macro to add the offset of 12 for PPS\n\u003e=12.\n\nv3: Add correct paranthesis for pps argument (Jani Nikula)\n\n(cherry picked from commit 6074be620c31dc2ae11af96a1a5ea95580976fb5)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T08:45:50.831Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ff5999fb03f467e1e7159f0ddb199c787f7512b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/962ac2dce56bb3aad1f82a4bbe3ada57a020287c"
        }
      ],
      "title": "drm/i915/dsc: Fix the macro that calculates DSCC_/DSCA_ PPS reg address",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26721",
    "datePublished": "2024-04-03T14:55:20.995Z",
    "dateReserved": "2024-02-19T14:20:24.162Z",
    "dateUpdated": "2024-12-19T08:45:50.831Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26721\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-03T15:15:54.043\",\"lastModified\":\"2024-11-21T09:02:55.100\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/i915/dsc: Fix the macro that calculates DSCC_/DSCA_ PPS reg address\\n\\nCommit bd077259d0a9 (\\\"drm/i915/vdsc: Add function to read any PPS\\nregister\\\") defines a new macro to calculate the DSC PPS register\\naddresses with PPS number as an input. This macro correctly calculates\\nthe addresses till PPS 11 since the addresses increment by 4. So in that\\ncase the following macro works correctly to give correct register\\naddress:\\n\\n_MMIO(_DSCA_PPS_0 + (pps) * 4)\\n\\nHowever after PPS 11, the register address for PPS 12 increments by 12\\nbecause of RC Buffer memory allocation in between. Because of this\\ndiscontinuity in the address space, the macro calculates wrong addresses\\nfor PPS 12 - 16 resulting into incorrect DSC PPS parameter value\\nread/writes causing DSC corruption.\\n\\nThis fixes it by correcting this macro to add the offset of 12 for PPS\\n\u003e=12.\\n\\nv3: Add correct paranthesis for pps argument (Jani Nikula)\\n\\n(cherry picked from commit 6074be620c31dc2ae11af96a1a5ea95580976fb5)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: drm/i915/dsc: corrige la macro que calcula la direcci\u00f3n de registro DSCC_/DSCA_ PPS Commit bd077259d0a9 (\\\"drm/i915/vdsc: Agregar funci\u00f3n para leer cualquier registro PPS\\\") define un Nueva macro para calcular las direcciones de registro DSC PPS con el n\u00famero PPS como entrada. Esta macro calcula correctamente las direcciones hasta PPS 11 ya que las direcciones se incrementan en 4. Entonces, en ese caso, la siguiente macro funciona correctamente para proporcionar la direcci\u00f3n de registro correcta: _MMIO(_DSCA_PPS_0 + (pps) * 4) Sin embargo, despu\u00e9s de PPS 11, la direcci\u00f3n de registro para PPS 12 se incrementa en 12 debido a la asignaci\u00f3n de memoria del b\u00fafer RC en el medio. Debido a esta discontinuidad en el espacio de direcciones, la macro calcula direcciones incorrectas para PPS 12 - 16, lo que genera lecturas/escrituras incorrectas del valor del par\u00e1metro PPS de DSC, lo que provoca corrupci\u00f3n de DSC. Esto se soluciona corrigiendo esta macro para agregar el desplazamiento de 12 para PPS \u0026gt;=12. v3: agregue par\u00e9ntesis correcto para el argumento pps (Jani Nikula) (seleccionado del commit 6074be620c31dc2ae11af96a1a5ea95580976fb5)\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/962ac2dce56bb3aad1f82a4bbe3ada57a020287c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ff5999fb03f467e1e7159f0ddb199c787f7512b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/962ac2dce56bb3aad1f82a4bbe3ada57a020287c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/ff5999fb03f467e1e7159f0ddb199c787f7512b9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.