CVE-2024-38552 (GCVE-0-2024-38552)
Vulnerability from cvelistv5 – Published: 2024-06-19 13:35 – Updated: 2026-08-05 11:32
VLAI
EPSS
VEX
Title
drm/amd/display: Fix potential index out of bounds in color transformation function
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix potential index out of bounds in color transformation function
Fixes index out of bounds issue in the color transformation function.
The issue could occur when the index 'i' exceeds the number of transfer
function points (TRANSFER_FUNC_POINTS).
The fix adds a check to ensure 'i' is within bounds before accessing the
transfer function points. If 'i' is out of bounds, an error message is
logged and the function returns false to indicate an error.
Reported by smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:14 UTC
Assigner
References
11 references
Impacted products
3 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
b629596072e5fa901c84f9e88d845a696ee32942 , < 604c506ca43fce52bb882cff9c1fdf2ec3b4029c
(git)
Affected: b629596072e5fa901c84f9e88d845a696ee32942 , < e280ab978c81443103d7c61bdd1d8d708cf6ed6d (git) Affected: b629596072e5fa901c84f9e88d845a696ee32942 , < 04bc4d1090c343025d69149ca669a27c5b9c34a7 (git) Affected: b629596072e5fa901c84f9e88d845a696ee32942 , < ced9c4e2289a786b8fa684d8893b7045ea53ef7e (git) Affected: b629596072e5fa901c84f9e88d845a696ee32942 , < 98b8a6bfd30d07a19cfacdf82b50f84bf3360869 (git) Affected: b629596072e5fa901c84f9e88d845a696ee32942 , < 4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86 (git) Affected: b629596072e5fa901c84f9e88d845a696ee32942 , < 123edbae64f4d21984359b99c6e79fcde31c6123 (git) Affected: b629596072e5fa901c84f9e88d845a696ee32942 , < 7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29 (git) Affected: b629596072e5fa901c84f9e88d845a696ee32942 , < 63ae548f1054a0b71678d0349c7dc9628ddd42ca (git) |
guessed | |
| Linux | Linux |
Affected:
4.16
Unaffected: 0 , < 4.16 (semver) Unaffected: 4.19.316 , ≤ 4.19.* (semver) Unaffected: 5.4.278 , ≤ 5.4.* (semver) Unaffected: 5.10.219 , ≤ 5.10.* (semver) Unaffected: 5.15.161 , ≤ 5.15.* (semver) Unaffected: 6.1.93 , ≤ 6.1.* (semver) Unaffected: 6.6.33 , ≤ 6.6.* (semver) Unaffected: 6.8.12 , ≤ 6.8.* (semver) Unaffected: 6.9.3 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix) |
guessed | |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem |
Affected:
0 , < *
(custom)
|
guessed |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-04T17:21:24.332Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/604c506ca43fce52bb882cff9c1fdf2ec3b4029c"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/e280ab978c81443103d7c61bdd1d8d708cf6ed6d"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/04bc4d1090c343025d69149ca669a27c5b9c34a7"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/ced9c4e2289a786b8fa684d8893b7045ea53ef7e"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/98b8a6bfd30d07a19cfacdf82b50f84bf3360869"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/63ae548f1054a0b71678d0349c7dc9628ddd42ca"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-38552",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T17:14:50.788974Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T17:34:57.332Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T11:54:36.137Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "604c506ca43fce52bb882cff9c1fdf2ec3b4029c",
"status": "affected",
"version": "b629596072e5fa901c84f9e88d845a696ee32942",
"versionType": "git"
},
{
"lessThan": "e280ab978c81443103d7c61bdd1d8d708cf6ed6d",
"status": "affected",
"version": "b629596072e5fa901c84f9e88d845a696ee32942",
"versionType": "git"
},
{
"lessThan": "04bc4d1090c343025d69149ca669a27c5b9c34a7",
"status": "affected",
"version": "b629596072e5fa901c84f9e88d845a696ee32942",
"versionType": "git"
},
{
"lessThan": "ced9c4e2289a786b8fa684d8893b7045ea53ef7e",
"status": "affected",
"version": "b629596072e5fa901c84f9e88d845a696ee32942",
"versionType": "git"
},
{
"lessThan": "98b8a6bfd30d07a19cfacdf82b50f84bf3360869",
"status": "affected",
"version": "b629596072e5fa901c84f9e88d845a696ee32942",
"versionType": "git"
},
{
"lessThan": "4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86",
"status": "affected",
"version": "b629596072e5fa901c84f9e88d845a696ee32942",
"versionType": "git"
},
{
"lessThan": "123edbae64f4d21984359b99c6e79fcde31c6123",
"status": "affected",
"version": "b629596072e5fa901c84f9e88d845a696ee32942",
"versionType": "git"
},
{
"lessThan": "7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29",
"status": "affected",
"version": "b629596072e5fa901c84f9e88d845a696ee32942",
"versionType": "git"
},
{
"lessThan": "63ae548f1054a0b71678d0349c7dc9628ddd42ca",
"status": "affected",
"version": "b629596072e5fa901c84f9e88d845a696ee32942",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.316",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.278",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.219",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.8.*",
"status": "unaffected",
"version": "6.8.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.9.*",
"status": "unaffected",
"version": "6.9.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.10",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.316",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.278",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.219",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.161",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.93",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.33",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.12",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.3",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.10",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix potential index out of bounds in color transformation function\n\nFixes index out of bounds issue in the color transformation function.\nThe issue could occur when the index \u0027i\u0027 exceeds the number of transfer\nfunction points (TRANSFER_FUNC_POINTS).\n\nThe fix adds a check to ensure \u0027i\u0027 is within bounds before accessing the\ntransfer function points. If \u0027i\u0027 is out of bounds, an error message is\nlogged and the function returns false to indicate an error.\n\nReported by smatch:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: buffer overflow \u0027output_tf-\u003etf_pts.red\u0027 1025 \u003c= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: buffer overflow \u0027output_tf-\u003etf_pts.green\u0027 1025 \u003c= s32max\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 cm_helper_translate_curve_to_hw_format() error: buffer overflow \u0027output_tf-\u003etf_pts.blue\u0027 1025 \u003c= s32max"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The code is reached only through the DRM atomic modeset ioctl on /dev/dri/cardN (amdgpu_dm color management \u2192 dcn*_set_output_transfer_func); there is no network or remote-peer path into the AMD display color pipeline.\nAC:L - The attacker directly supplies the GAMMA_LUT/DEGAMMA_LUT blobs and the shaper/blend transfer-function enums that drive the loop, and can re-issue the atomic commit at will with no race and no dependence on unpredictable system state.\nPR:L - DRM_IOCTL_MODE_ATOMIC is gated on DRM_MASTER (drm_ioctl.c:701), which the logged-in seat user or a member of the video group holds on the active VT \u2014 no root or CAP_SYS_ADMIN is required.\nUI:N - The attacker performs the atomic commit itself; no victim action, no filesystem mount, and no separate user interaction is needed.\nS:U - The out-of-bounds access stays within the kernel\u0027s own memory and the amdgpu driver\u0027s security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The flagged defect is an unbounded out-of-bounds read past the 1025-entry tf_pts arrays inside the kernel heap object, not a read strictly bounded to a few bytes, so adjacent kernel heap contents can be sampled and pushed into the display pipeline.\nI:L - The out-of-bounds values are converted and programmed into the DPP regamma/shaper hardware LUT, corrupting display output with attacker-uncontrolled kernel data; there is no out-of-bounds write and no control-flow hijack primitive, so impact is limited.\nA:H - An out-of-bounds read at a large index can touch an unmapped page or trip KASAN/hardened-usercopy checks, oopsing in the atomic commit path while display locks are held, and an unprivileged seat user can retrigger it in a loop."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:32:43.970Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/604c506ca43fce52bb882cff9c1fdf2ec3b4029c"
},
{
"url": "https://git.kernel.org/stable/c/e280ab978c81443103d7c61bdd1d8d708cf6ed6d"
},
{
"url": "https://git.kernel.org/stable/c/04bc4d1090c343025d69149ca669a27c5b9c34a7"
},
{
"url": "https://git.kernel.org/stable/c/ced9c4e2289a786b8fa684d8893b7045ea53ef7e"
},
{
"url": "https://git.kernel.org/stable/c/98b8a6bfd30d07a19cfacdf82b50f84bf3360869"
},
{
"url": "https://git.kernel.org/stable/c/4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86"
},
{
"url": "https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123"
},
{
"url": "https://git.kernel.org/stable/c/7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29"
},
{
"url": "https://git.kernel.org/stable/c/63ae548f1054a0b71678d0349c7dc9628ddd42ca"
}
],
"title": "drm/amd/display: Fix potential index out of bounds in color transformation function",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-38552",
"datePublished": "2024-06-19T13:35:24.067Z",
"dateReserved": "2024-06-18T19:36:34.920Z",
"dateUpdated": "2026-08-05T11:32:43.970Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-38552",
"date": "2026-09-16",
"epss": "0.00297",
"percentile": "0.22405"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.16\", \"versionEndExcluding\": \"4.19.316\", \"matchCriteriaId\": \"ED5E0A5E-EF43-449A-90CC-20F2A9F6DBB5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.20\", \"versionEndExcluding\": \"5.4.278\", \"matchCriteriaId\": \"7FDBF235-DA18-49A1-8690-6C7272FD0701\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.219\", \"matchCriteriaId\": \"E9063AF3-D593-43B7-810D-58B87F82F9F9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.161\", \"matchCriteriaId\": \"31130639-53FE-4726-8986-434EE2528CB2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.93\", \"matchCriteriaId\": \"EEFB78EE-F990-4197-BF1C-156760A55667\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.33\", \"matchCriteriaId\": \"FCE796DF-3B50-4DC6-BAE5-95271068FC9E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.8.12\", \"matchCriteriaId\": \"80550309-67AB-4FD1-AC07-3DED5C4F01B2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.9\", \"versionEndExcluding\": \"6.9.3\", \"matchCriteriaId\": \"E07124C1-19E8-4D21-828D-9932A01D3011\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: Fix potential index out of bounds in color transformation function\\n\\nFixes index out of bounds issue in the color transformation function.\\nThe issue could occur when the index \u0027i\u0027 exceeds the number of transfer\\nfunction points (TRANSFER_FUNC_POINTS).\\n\\nThe fix adds a check to ensure \u0027i\u0027 is within bounds before accessing the\\ntransfer function points. If \u0027i\u0027 is out of bounds, an error message is\\nlogged and the function returns false to indicate an error.\\n\\nReported by smatch:\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: buffer overflow \u0027output_tf-\u003etf_pts.red\u0027 1025 \u003c= s32max\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: buffer overflow \u0027output_tf-\u003etf_pts.green\u0027 1025 \u003c= s32max\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 cm_helper_translate_curve_to_hw_format() error: buffer overflow \u0027output_tf-\u003etf_pts.blue\u0027 1025 \u003c= s32max\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: drm/amd/display: corrige un posible \\u00edndice fuera de los l\\u00edmites en la funci\\u00f3n de transformaci\\u00f3n de color. Corrige el problema de \\u00edndice fuera de los l\\u00edmites en la funci\\u00f3n de transformaci\\u00f3n de color. El problema podr\\u00eda ocurrir cuando el \\u00edndice \u0027i\u0027 excede la cantidad de puntos de funci\\u00f3n de transferencia (TRANSFER_FUNC_POINTS). La soluci\\u00f3n agrega una verificaci\\u00f3n para garantizar que \u0027i\u0027 est\\u00e9 dentro de los l\\u00edmites antes de acceder a los puntos de funci\\u00f3n de transferencia. Si \u0027i\u0027 est\\u00e1 fuera de los l\\u00edmites, se registra un mensaje de error y la funci\\u00f3n devuelve falso para indicar un error. Reportado por smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: desbordamiento del b\\u00fafer \u0027output_tf-\u0026gt;tf_pts.red\u0027 1025 \u0026lt;= controladores s32max/gpu /drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: desbordamiento del b\\u00fafer \u0027output_tf-\u0026gt;tf_pts.green\u0027 1025 \u0026lt;= controladores s32max/gpu/drm/amd/amdgpu/ ../display/dc/dcn10/dcn10_cm_common.c:407 error de cm_helper_translate_curve_to_hw_format(): desbordamiento del b\\u00fafer \u0027output_tf-\u0026gt;tf_pts.blue\u0027 1025 \u0026lt;= s32max\"}]",
"id": "CVE-2024-38552",
"lastModified": "2024-11-21T09:26:19.673",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
"published": "2024-06-19T14:15:15.450",
"references": "[{\"url\": \"https://git.kernel.org/stable/c/04bc4d1090c343025d69149ca669a27c5b9c34a7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/604c506ca43fce52bb882cff9c1fdf2ec3b4029c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/63ae548f1054a0b71678d0349c7dc9628ddd42ca\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/98b8a6bfd30d07a19cfacdf82b50f84bf3360869\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ced9c4e2289a786b8fa684d8893b7045ea53ef7e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e280ab978c81443103d7c61bdd1d8d708cf6ed6d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/04bc4d1090c343025d69149ca669a27c5b9c34a7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/604c506ca43fce52bb882cff9c1fdf2ec3b4029c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/63ae548f1054a0b71678d0349c7dc9628ddd42ca\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/98b8a6bfd30d07a19cfacdf82b50f84bf3360869\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ced9c4e2289a786b8fa684d8893b7045ea53ef7e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e280ab978c81443103d7c61bdd1d8d708cf6ed6d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-129\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-38552\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-19T14:15:15.450\",\"lastModified\":\"2026-08-04T11:18:43.230\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: Fix potential index out of bounds in color transformation function\\n\\nFixes index out of bounds issue in the color transformation function.\\nThe issue could occur when the index \u0027i\u0027 exceeds the number of transfer\\nfunction points (TRANSFER_FUNC_POINTS).\\n\\nThe fix adds a check to ensure \u0027i\u0027 is within bounds before accessing the\\ntransfer function points. If \u0027i\u0027 is out of bounds, an error message is\\nlogged and the function returns false to indicate an error.\\n\\nReported by smatch:\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: buffer overflow \u0027output_tf-\u003etf_pts.red\u0027 1025 \u003c= s32max\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: buffer overflow \u0027output_tf-\u003etf_pts.green\u0027 1025 \u003c= s32max\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 cm_helper_translate_curve_to_hw_format() error: buffer overflow \u0027output_tf-\u003etf_pts.blue\u0027 1025 \u003c= s32max\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: drm/amd/display: corrige un posible \u00edndice fuera de los l\u00edmites en la funci\u00f3n de transformaci\u00f3n de color. Corrige el problema de \u00edndice fuera de los l\u00edmites en la funci\u00f3n de transformaci\u00f3n de color. El problema podr\u00eda ocurrir cuando el \u00edndice \u0027i\u0027 excede la cantidad de puntos de funci\u00f3n de transferencia (TRANSFER_FUNC_POINTS). La soluci\u00f3n agrega una verificaci\u00f3n para garantizar que \u0027i\u0027 est\u00e9 dentro de los l\u00edmites antes de acceder a los puntos de funci\u00f3n de transferencia. Si \u0027i\u0027 est\u00e1 fuera de los l\u00edmites, se registra un mensaje de error y la funci\u00f3n devuelve falso para indicar un error. Reportado por smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: desbordamiento del b\u00fafer \u0027output_tf-\u0026gt;tf_pts.red\u0027 1025 \u0026lt;= controladores s32max/gpu /drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: desbordamiento del b\u00fafer \u0027output_tf-\u0026gt;tf_pts.green\u0027 1025 \u0026lt;= controladores s32max/gpu/drm/amd/amdgpu/ ../display/dc/dcn10/dcn10_cm_common.c:407 error de cm_helper_translate_curve_to_hw_format(): desbordamiento del b\u00fafer \u0027output_tf-\u0026gt;tf_pts.blue\u0027 1025 \u0026lt;= s32max\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b629596072e5fa901c84f9e88d845a696ee32942\",\"lessThan\":\"604c506ca43fce52bb882cff9c1fdf2ec3b4029c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b629596072e5fa901c84f9e88d845a696ee32942\",\"lessThan\":\"e280ab978c81443103d7c61bdd1d8d708cf6ed6d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b629596072e5fa901c84f9e88d845a696ee32942\",\"lessThan\":\"04bc4d1090c343025d69149ca669a27c5b9c34a7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b629596072e5fa901c84f9e88d845a696ee32942\",\"lessThan\":\"ced9c4e2289a786b8fa684d8893b7045ea53ef7e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b629596072e5fa901c84f9e88d845a696ee32942\",\"lessThan\":\"98b8a6bfd30d07a19cfacdf82b50f84bf3360869\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b629596072e5fa901c84f9e88d845a696ee32942\",\"lessThan\":\"4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b629596072e5fa901c84f9e88d845a696ee32942\",\"lessThan\":\"123edbae64f4d21984359b99c6e79fcde31c6123\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b629596072e5fa901c84f9e88d845a696ee32942\",\"lessThan\":\"7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b629596072e5fa901c84f9e88d845a696ee32942\",\"lessThan\":\"63ae548f1054a0b71678d0349c7dc9628ddd42ca\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.316\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.278\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.219\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.161\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.93\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.33\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.12\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.3\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:14:50.788974Z\",\"id\":\"CVE-2024-38552\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-129\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.16\",\"versionEndExcluding\":\"4.19.316\",\"matchCriteriaId\":\"ED5E0A5E-EF43-449A-90CC-20F2A9F6DBB5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.278\",\"matchCriteriaId\":\"7FDBF235-DA18-49A1-8690-6C7272FD0701\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.219\",\"matchCriteriaId\":\"E9063AF3-D593-43B7-810D-58B87F82F9F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.161\",\"matchCriteriaId\":\"31130639-53FE-4726-8986-434EE2528CB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.93\",\"matchCriteriaId\":\"EEFB78EE-F990-4197-BF1C-156760A55667\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.33\",\"matchCriteriaId\":\"FCE796DF-3B50-4DC6-BAE5-95271068FC9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.12\",\"matchCriteriaId\":\"80550309-67AB-4FD1-AC07-3DED5C4F01B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.9.3\",\"matchCriteriaId\":\"E07124C1-19E8-4D21-828D-9932A01D3011\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04bc4d1090c343025d69149ca669a27c5b9c34a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/604c506ca43fce52bb882cff9c1fdf2ec3b4029c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/63ae548f1054a0b71678d0349c7dc9628ddd42ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/98b8a6bfd30d07a19cfacdf82b50f84bf3360869\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ced9c4e2289a786b8fa684d8893b7045ea53ef7e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e280ab978c81443103d7c61bdd1d8d708cf6ed6d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/04bc4d1090c343025d69149ca669a27c5b9c34a7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/604c506ca43fce52bb882cff9c1fdf2ec3b4029c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/63ae548f1054a0b71678d0349c7dc9628ddd42ca\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/98b8a6bfd30d07a19cfacdf82b50f84bf3360869\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ced9c4e2289a786b8fa684d8893b7045ea53ef7e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e280ab978c81443103d7c61bdd1d8d708cf6ed6d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
"redhat_vex": {
"aggregate_severity": "Low",
"current_release_date": "2026-08-04T22:46:37+00:00",
"cve": "CVE-2024-38552",
"id": "CVE-2024-38552",
"initial_release_date": "2024-06-19T00:00:00+00:00",
"product_status:known_not_affected": "198",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: drm/amd/display: Fix potential index out of bounds in color transformation function",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-38552.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-02T01:29:20Z",
"cve": "CVE-2024-38552",
"id": "CVE-2024-38552",
"initial_release_date": "2024-06-22T03:35:34Z",
"product_status:known_affected": "507",
"product_status:known_not_affected": "96",
"product_status:recommended": "721",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2024-38552",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-38552.json",
"version": "96"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/604c506ca43fce52bb882cff9c1fdf2ec3b4029c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e280ab978c81443103d7c61bdd1d8d708cf6ed6d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/04bc4d1090c343025d69149ca669a27c5b9c34a7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ced9c4e2289a786b8fa684d8893b7045ea53ef7e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/98b8a6bfd30d07a19cfacdf82b50f84bf3360869\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/63ae548f1054a0b71678d0349c7dc9628ddd42ca\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T17:21:24.332Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T11:54:36.137Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-38552\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:14:50.788974Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:27.134Z\"}}], \"cna\": {\"title\": \"drm/amd/display: Fix potential index out of bounds in color transformation function\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The code is reached only through the DRM atomic modeset ioctl on /dev/dri/cardN (amdgpu_dm color management \\u2192 dcn*_set_output_transfer_func); there is no network or remote-peer path into the AMD display color pipeline.\\nAC:L - The attacker directly supplies the GAMMA_LUT/DEGAMMA_LUT blobs and the shaper/blend transfer-function enums that drive the loop, and can re-issue the atomic commit at will with no race and no dependence on unpredictable system state.\\nPR:L - DRM_IOCTL_MODE_ATOMIC is gated on DRM_MASTER (drm_ioctl.c:701), which the logged-in seat user or a member of the video group holds on the active VT \\u2014 no root or CAP_SYS_ADMIN is required.\\nUI:N - The attacker performs the atomic commit itself; no victim action, no filesystem mount, and no separate user interaction is needed.\\nS:U - The out-of-bounds access stays within the kernel\u0027s own memory and the amdgpu driver\u0027s security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The flagged defect is an unbounded out-of-bounds read past the 1025-entry tf_pts arrays inside the kernel heap object, not a read strictly bounded to a few bytes, so adjacent kernel heap contents can be sampled and pushed into the display pipeline.\\nI:L - The out-of-bounds values are converted and programmed into the DPP regamma/shaper hardware LUT, corrupting display output with attacker-uncontrolled kernel data; there is no out-of-bounds write and no control-flow hijack primitive, so impact is limited.\\nA:H - An out-of-bounds read at a large index can touch an unmapped page or trip KASAN/hardened-usercopy checks, oopsing in the atomic commit path while display locks are held, and an unprivileged seat user can retrigger it in a loop.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b629596072e5fa901c84f9e88d845a696ee32942\", \"lessThan\": \"604c506ca43fce52bb882cff9c1fdf2ec3b4029c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b629596072e5fa901c84f9e88d845a696ee32942\", \"lessThan\": \"e280ab978c81443103d7c61bdd1d8d708cf6ed6d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b629596072e5fa901c84f9e88d845a696ee32942\", \"lessThan\": \"04bc4d1090c343025d69149ca669a27c5b9c34a7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b629596072e5fa901c84f9e88d845a696ee32942\", \"lessThan\": \"ced9c4e2289a786b8fa684d8893b7045ea53ef7e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b629596072e5fa901c84f9e88d845a696ee32942\", \"lessThan\": \"98b8a6bfd30d07a19cfacdf82b50f84bf3360869\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b629596072e5fa901c84f9e88d845a696ee32942\", \"lessThan\": \"4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b629596072e5fa901c84f9e88d845a696ee32942\", \"lessThan\": \"123edbae64f4d21984359b99c6e79fcde31c6123\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b629596072e5fa901c84f9e88d845a696ee32942\", \"lessThan\": \"7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b629596072e5fa901c84f9e88d845a696ee32942\", \"lessThan\": \"63ae548f1054a0b71678d0349c7dc9628ddd42ca\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.316\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.278\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.219\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.161\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/604c506ca43fce52bb882cff9c1fdf2ec3b4029c\"}, {\"url\": \"https://git.kernel.org/stable/c/e280ab978c81443103d7c61bdd1d8d708cf6ed6d\"}, {\"url\": \"https://git.kernel.org/stable/c/04bc4d1090c343025d69149ca669a27c5b9c34a7\"}, {\"url\": \"https://git.kernel.org/stable/c/ced9c4e2289a786b8fa684d8893b7045ea53ef7e\"}, {\"url\": \"https://git.kernel.org/stable/c/98b8a6bfd30d07a19cfacdf82b50f84bf3360869\"}, {\"url\": \"https://git.kernel.org/stable/c/4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86\"}, {\"url\": \"https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123\"}, {\"url\": \"https://git.kernel.org/stable/c/7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29\"}, {\"url\": \"https://git.kernel.org/stable/c/63ae548f1054a0b71678d0349c7dc9628ddd42ca\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: Fix potential index out of bounds in color transformation function\\n\\nFixes index out of bounds issue in the color transformation function.\\nThe issue could occur when the index \u0027i\u0027 exceeds the number of transfer\\nfunction points (TRANSFER_FUNC_POINTS).\\n\\nThe fix adds a check to ensure \u0027i\u0027 is within bounds before accessing the\\ntransfer function points. If \u0027i\u0027 is out of bounds, an error message is\\nlogged and the function returns false to indicate an error.\\n\\nReported by smatch:\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: buffer overflow \u0027output_tf-\u003etf_pts.red\u0027 1025 \u003c= s32max\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: buffer overflow \u0027output_tf-\u003etf_pts.green\u0027 1025 \u003c= s32max\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 cm_helper_translate_curve_to_hw_format() error: buffer overflow \u0027output_tf-\u003etf_pts.blue\u0027 1025 \u003c= s32max\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.316\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.278\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.219\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.161\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.93\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.33\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.12\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.3\", \"versionStartIncluding\": \"4.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"4.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:32:43.970Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-38552\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:32:43.970Z\", \"dateReserved\": \"2024-06-18T19:36:34.920Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-19T13:35:24.067Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…