CVE-2024-46817

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6

[Why] Coverity reports OVERRUN warning. Should abort amdgpu_dm initialize.

[How] Return failure to amdgpu_dm_init.

A flaw was found in the Linux kernel AMD display manager (amdgpu_dm) driver, in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c. During amdgpu_dm initialization, the driver does not abort when the number of display streams exceeds the maximum of six streams supported by its internal arrays, which can result in an out-of-bounds array access (reported by Coverity as an OVERRUN warning). Red Hat rates this flaw as Low impact because triggering the issue requires local access with high privileges and impacts availability only (RH CVSS 4.4, AV:L/AC:L/PR:H, C:N/I:N/A:H). All Red Hat Enterprise Linux kernel and kernel-rt streams are currently listed as not affected by this flaw; only the Fedora community kernel is affected, and a fix is being pursued through the community kernel process (delegated resolution). The upstream CVE record severity (CVEORG CVSS 7.4, Important) is higher than Red Hat's assessment (4.4, Moderate) due to differences in the scored privileges required and impact dimensions (CVEORG scores PR:N with C:H/I:H/A:H, while Red Hat scores PR:H with availability-only impact).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.