CVE-2022-48979

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: fix array index out of bound error in DCN32 DML

[Why&How] LinkCapacitySupport array is indexed with the number of voltage states and not the number of max DPPs. Fix the error by changing the array declaration to use the correct (larger) array size of total number of voltage states.

A low severity out-of-bounds array access was found in the AMD display driver (drm/amd/display) in the Linux kernel, specifically in the DCN32 Display Mode Library (DML). The LinkCapacitySupport array was declared with the number of maximum DPPs as its size, but the code indexes it with the number of voltage states; when the number of voltage states exceeds the number of DPPs, the DML accesses memory beyond the end of the array, which can result in kernel memory corruption and a kernel panic. The impact is limited to availability (local denial of service); there is no evidence of confidentiality or integrity impact. Triggering the flaw requires local access on systems with AMD graphics hardware that use the DCN32 display engine, and Red Hat scoring additionally requires high privileges (CVSS 4.4, AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Red Hat Enterprise Linux 8 and 9 (kernel and kernel-rt) and the Hosted OpenShift (ARO and OSD) clusters are affected, and the fix is currently deferred because of the low severity and the narrow hardware and code-path exposure; the residual risk is a local kernel panic on affected AMD DCN32 configurations. Fedora is currently marked as not affected. The Red Hat severity is lower than the NIST score (5.5) because of the high privileges required, and substantially lower than the CVE.org score (7.8), whose confidentiality and integrity impacts do not match the availability-only nature of this out-of-bounds array access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.