CVE-2024-56608 (GCVE-0-2024-56608)

Vulnerability from cvelistv5 – Published: 2024-12-27 14:51 – Updated: 2026-08-05 11:45
VLAI
Title
drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' An issue was identified in the dcn21_link_encoder_create function where an out-of-bounds access could occur when the hpd_source index was used to reference the link_enc_hpd_regs array. This array has a fixed size and the index was not being checked against the array's bounds before accessing it. This fix adds a conditional check to ensure that the hpd_source index is within the valid range of the link_enc_hpd_regs array. If the index is out of bounds, the function now returns NULL to prevent undefined behavior. References: [ 65.920507] ------------[ cut here ]------------ [ 65.920510] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn21/dcn21_resource.c:1312:29 [ 65.920519] index 7 is out of range for type 'dcn10_link_enc_hpd_registers [5]' [ 65.920523] CPU: 3 PID: 1178 Comm: modprobe Tainted: G OE 6.8.0-cleanershaderfeatureresetasdntipmi200nv2132 #13 [ 65.920525] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS WMJ0429N_Weekly_20_04_2 04/29/2020 [ 65.920527] Call Trace: [ 65.920529] <TASK> [ 65.920532] dump_stack_lvl+0x48/0x70 [ 65.920541] dump_stack+0x10/0x20 [ 65.920543] __ubsan_handle_out_of_bounds+0xa2/0xe0 [ 65.920549] dcn21_link_encoder_create+0xd9/0x140 [amdgpu] [ 65.921009] link_create+0x6d3/0xed0 [amdgpu] [ 65.921355] create_links+0x18a/0x4e0 [amdgpu] [ 65.921679] dc_create+0x360/0x720 [amdgpu] [ 65.921999] ? dmi_matches+0xa0/0x220 [ 65.922004] amdgpu_dm_init+0x2b6/0x2c90 [amdgpu] [ 65.922342] ? console_unlock+0x77/0x120 [ 65.922348] ? dev_printk_emit+0x86/0xb0 [ 65.922354] dm_hw_init+0x15/0x40 [amdgpu] [ 65.922686] amdgpu_device_init+0x26a8/0x33a0 [amdgpu] [ 65.922921] amdgpu_driver_load_kms+0x1b/0xa0 [amdgpu] [ 65.923087] amdgpu_pci_probe+0x1b7/0x630 [amdgpu] [ 65.923087] local_pci_probe+0x4b/0xb0 [ 65.923087] pci_device_probe+0xc8/0x280 [ 65.923087] really_probe+0x187/0x300 [ 65.923087] __driver_probe_device+0x85/0x130 [ 65.923087] driver_probe_device+0x24/0x110 [ 65.923087] __driver_attach+0xac/0x1d0 [ 65.923087] ? __pfx___driver_attach+0x10/0x10 [ 65.923087] bus_for_each_dev+0x7d/0xd0 [ 65.923087] driver_attach+0x1e/0x30 [ 65.923087] bus_add_driver+0xf2/0x200 [ 65.923087] driver_register+0x64/0x130 [ 65.923087] ? __pfx_amdgpu_init+0x10/0x10 [amdgpu] [ 65.923087] __pci_register_driver+0x61/0x70 [ 65.923087] amdgpu_init+0x7d/0xff0 [amdgpu] [ 65.923087] do_one_initcall+0x49/0x310 [ 65.923087] ? kmalloc_trace+0x136/0x360 [ 65.923087] do_init_module+0x6a/0x270 [ 65.923087] load_module+0x1fce/0x23a0 [ 65.923087] init_module_from_file+0x9c/0xe0 [ 65.923087] ? init_module_from_file+0x9c/0xe0 [ 65.923087] idempotent_init_module+0x179/0x230 [ 65.923087] __x64_sys_finit_module+0x5d/0xa0 [ 65.923087] do_syscall_64+0x76/0x120 [ 65.923087] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 65.923087] RIP: 0033:0x7f2d80f1e88d [ 65.923087] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48 [ 65.923087] RSP: 002b:00007ffc7bc1aa78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 65.923087] RAX: ffffffffffffffda RBX: 0000564c9c1db130 RCX: 00007f2d80f1e88d [ 65.923087] RDX: 0000000000000000 RSI: 0000564c9c1e5480 RDI: 000000000000000f [ 65.923087] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000002 [ 65.923087] R10: 000000000000000f R11: 0000000000000246 R12: 0000564c9c1e5480 [ 65.923087] R13: 0000564c9c1db260 R14: 0000000000000000 R15: 0000564c9c1e54b0 [ 65.923087] </TASK> [ 65.923927] ---[ end trace ]---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < 280f722601c8bf4d8a9c62dd727cf3a2fd0a47be (git)
Affected: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < b19ca8425a4b86e8f0d7c33c4e87ef7b0ebdaa29 (git)
Affected: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < 5bd410c21037107b83ffbb51dd2d6460f9de9ed1 (git)
Affected: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < 08ac5fdb9c6dc34d0ed4bc64ce3c5c3d411b3b53 (git)
Affected: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < f01ddd589e162979421e6914b1c74018633f01e0 (git)
Affected: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < 63de35a8fcfca59ae8750d469a7eb220c7557baf (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.15
Unaffected: 0 , < 4.15 (semver)
Unaffected: 5.10.237 , ≤ 5.10.* (semver)
Unaffected: 5.15.181 , ≤ 5.15.* (semver)
Unaffected: 6.1.127 , ≤ 6.1.* (semver)
Unaffected: 6.6.74 , ≤ 6.6.* (semver)
Unaffected: 6.12.5 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:50:55.342Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "280f722601c8bf4d8a9c62dd727cf3a2fd0a47be",
              "status": "affected",
              "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
              "versionType": "git"
            },
            {
              "lessThan": "b19ca8425a4b86e8f0d7c33c4e87ef7b0ebdaa29",
              "status": "affected",
              "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
              "versionType": "git"
            },
            {
              "lessThan": "5bd410c21037107b83ffbb51dd2d6460f9de9ed1",
              "status": "affected",
              "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
              "versionType": "git"
            },
            {
              "lessThan": "08ac5fdb9c6dc34d0ed4bc64ce3c5c3d411b3b53",
              "status": "affected",
              "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
              "versionType": "git"
            },
            {
              "lessThan": "f01ddd589e162979421e6914b1c74018633f01e0",
              "status": "affected",
              "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
              "versionType": "git"
            },
            {
              "lessThan": "63de35a8fcfca59ae8750d469a7eb220c7557baf",
              "status": "affected",
              "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.237",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.127",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.74",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.237",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.181",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.127",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.74",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix out-of-bounds access in \u0027dcn21_link_encoder_create\u0027\n\nAn issue was identified in the dcn21_link_encoder_create function where\nan out-of-bounds access could occur when the hpd_source index was used\nto reference the link_enc_hpd_regs array. This array has a fixed size\nand the index was not being checked against the array\u0027s bounds before\naccessing it.\n\nThis fix adds a conditional check to ensure that the hpd_source index is\nwithin the valid range of the link_enc_hpd_regs array. If the index is\nout of bounds, the function now returns NULL to prevent undefined\nbehavior.\n\nReferences:\n\n[   65.920507] ------------[ cut here ]------------\n[   65.920510] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn21/dcn21_resource.c:1312:29\n[   65.920519] index 7 is out of range for type \u0027dcn10_link_enc_hpd_registers [5]\u0027\n[   65.920523] CPU: 3 PID: 1178 Comm: modprobe Tainted: G           OE      6.8.0-cleanershaderfeatureresetasdntipmi200nv2132 #13\n[   65.920525] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS WMJ0429N_Weekly_20_04_2 04/29/2020\n[   65.920527] Call Trace:\n[   65.920529]  \u003cTASK\u003e\n[   65.920532]  dump_stack_lvl+0x48/0x70\n[   65.920541]  dump_stack+0x10/0x20\n[   65.920543]  __ubsan_handle_out_of_bounds+0xa2/0xe0\n[   65.920549]  dcn21_link_encoder_create+0xd9/0x140 [amdgpu]\n[   65.921009]  link_create+0x6d3/0xed0 [amdgpu]\n[   65.921355]  create_links+0x18a/0x4e0 [amdgpu]\n[   65.921679]  dc_create+0x360/0x720 [amdgpu]\n[   65.921999]  ? dmi_matches+0xa0/0x220\n[   65.922004]  amdgpu_dm_init+0x2b6/0x2c90 [amdgpu]\n[   65.922342]  ? console_unlock+0x77/0x120\n[   65.922348]  ? dev_printk_emit+0x86/0xb0\n[   65.922354]  dm_hw_init+0x15/0x40 [amdgpu]\n[   65.922686]  amdgpu_device_init+0x26a8/0x33a0 [amdgpu]\n[   65.922921]  amdgpu_driver_load_kms+0x1b/0xa0 [amdgpu]\n[   65.923087]  amdgpu_pci_probe+0x1b7/0x630 [amdgpu]\n[   65.923087]  local_pci_probe+0x4b/0xb0\n[   65.923087]  pci_device_probe+0xc8/0x280\n[   65.923087]  really_probe+0x187/0x300\n[   65.923087]  __driver_probe_device+0x85/0x130\n[   65.923087]  driver_probe_device+0x24/0x110\n[   65.923087]  __driver_attach+0xac/0x1d0\n[   65.923087]  ? __pfx___driver_attach+0x10/0x10\n[   65.923087]  bus_for_each_dev+0x7d/0xd0\n[   65.923087]  driver_attach+0x1e/0x30\n[   65.923087]  bus_add_driver+0xf2/0x200\n[   65.923087]  driver_register+0x64/0x130\n[   65.923087]  ? __pfx_amdgpu_init+0x10/0x10 [amdgpu]\n[   65.923087]  __pci_register_driver+0x61/0x70\n[   65.923087]  amdgpu_init+0x7d/0xff0 [amdgpu]\n[   65.923087]  do_one_initcall+0x49/0x310\n[   65.923087]  ? kmalloc_trace+0x136/0x360\n[   65.923087]  do_init_module+0x6a/0x270\n[   65.923087]  load_module+0x1fce/0x23a0\n[   65.923087]  init_module_from_file+0x9c/0xe0\n[   65.923087]  ? init_module_from_file+0x9c/0xe0\n[   65.923087]  idempotent_init_module+0x179/0x230\n[   65.923087]  __x64_sys_finit_module+0x5d/0xa0\n[   65.923087]  do_syscall_64+0x76/0x120\n[   65.923087]  entry_SYSCALL_64_after_hwframe+0x6e/0x76\n[   65.923087] RIP: 0033:0x7f2d80f1e88d\n[   65.923087] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48\n[   65.923087] RSP: 002b:00007ffc7bc1aa78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139\n[   65.923087] RAX: ffffffffffffffda RBX: 0000564c9c1db130 RCX: 00007f2d80f1e88d\n[   65.923087] RDX: 0000000000000000 RSI: 0000564c9c1e5480 RDI: 000000000000000f\n[   65.923087] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000002\n[   65.923087] R10: 000000000000000f R11: 0000000000000246 R12: 0000564c9c1e5480\n[   65.923087] R13: 0000564c9c1db260 R14: 0000000000000000 R15: 0000564c9c1e54b0\n[   65.923087]  \u003c/TASK\u003e\n[   65.923927] ---[ end trace ]---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through amdgpu device probe (amdgpu_pci_probe \u2192 dm_hw_init \u2192 dc_create \u2192 create_links \u2192 dcn21_link_encoder_create), a local driver-initialization path with no network or remote-peer data involved. Triggering it requires local system access such as module load or PCI driver bind.\nAC:L - On an affected DCN2.1 platform the out-of-bounds index is produced deterministically every single probe, because get_hpd_line() returns HPD_SOURCEID_UNKNOWN (7) or HPD_SOURCEID6 (5) for the board\u0027s connector table \u2014 no race, no memory-layout luck, and no unpredictable state is required.\nPR:L - Reaching the path requires only the ability to cause the driver to initialize the display core on a local system; consistent with other drm/amd/display array-index CVEs, an ordinary local user context is credited rather than full administrative privilege.\nUI:N - The out-of-bounds access occurs automatically during driver initialization on affected hardware; no victim must open a file, plug in a display, or take any other action.\nS:U - The overread, the corrupted register-offset pointer, and all resulting effects stay within the kernel\u0027s own security authority \u2014 no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Kernel .rodata beyond link_enc_hpd_regs[] is read out of bounds and the value becomes an MMIO register offset, so unintended GPU registers are read back through the HPD read-modify-write path, giving an uncontrolled disclosure primitive over kernel constant data and device state.\nI:H - The bogus offset from the overread is used by HPD_REG_UPDATE \u2192 dm_write_reg \u2192 amdgpu_device_wreg to perform a read-modify-write to an arbitrary GPU register, corrupting display-hardware state that was never meant to be written.\nA:H - Writing DC_HPD_EN into an arbitrary register address produces undefined GPU behavior \u2014 display engine hangs, GPU resets, or kernel oops \u2014 and the UBSAN array-index-out-of-bounds report itself will panic the system when panic_on_warn or CONFIG_UBSAN_TRAP is set."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:45:28.174Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/280f722601c8bf4d8a9c62dd727cf3a2fd0a47be"
        },
        {
          "url": "https://git.kernel.org/stable/c/b19ca8425a4b86e8f0d7c33c4e87ef7b0ebdaa29"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bd410c21037107b83ffbb51dd2d6460f9de9ed1"
        },
        {
          "url": "https://git.kernel.org/stable/c/08ac5fdb9c6dc34d0ed4bc64ce3c5c3d411b3b53"
        },
        {
          "url": "https://git.kernel.org/stable/c/f01ddd589e162979421e6914b1c74018633f01e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/63de35a8fcfca59ae8750d469a7eb220c7557baf"
        }
      ],
      "title": "drm/amd/display: Fix out-of-bounds access in \u0027dcn21_link_encoder_create\u0027",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56608",
    "datePublished": "2024-12-27T14:51:13.210Z",
    "dateReserved": "2024-12-27T14:03:06.013Z",
    "dateUpdated": "2026-08-05T11:45:28.174Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56608",
      "date": "2026-10-06",
      "epss": "0.00258",
      "percentile": "0.15967"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "280f722601c8bf4d8a9c62dd727cf3a2fd0a47be",
                    "status": "affected",
                    "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b19ca8425a4b86e8f0d7c33c4e87ef7b0ebdaa29",
                    "status": "affected",
                    "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5bd410c21037107b83ffbb51dd2d6460f9de9ed1",
                    "status": "affected",
                    "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "08ac5fdb9c6dc34d0ed4bc64ce3c5c3d411b3b53",
                    "status": "affected",
                    "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f01ddd589e162979421e6914b1c74018633f01e0",
                    "status": "affected",
                    "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "63de35a8fcfca59ae8750d469a7eb220c7557baf",
                    "status": "affected",
                    "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.15"
                  },
                  {
                    "lessThan": "4.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.237",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.181",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.127",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.74",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.13",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "75E05E0A-C898-433A-8E50-6D9EC8646A64",
                    "versionEndExcluding": "6.12.5",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix out-of-bounds access in \u0027dcn21_link_encoder_create\u0027\n\nAn issue was identified in the dcn21_link_encoder_create function where\nan out-of-bounds access could occur when the hpd_source index was used\nto reference the link_enc_hpd_regs array. This array has a fixed size\nand the index was not being checked against the array\u0027s bounds before\naccessing it.\n\nThis fix adds a conditional check to ensure that the hpd_source index is\nwithin the valid range of the link_enc_hpd_regs array. If the index is\nout of bounds, the function now returns NULL to prevent undefined\nbehavior.\n\nReferences:\n\n[   65.920507] ------------[ cut here ]------------\n[   65.920510] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn21/dcn21_resource.c:1312:29\n[   65.920519] index 7 is out of range for type \u0027dcn10_link_enc_hpd_registers [5]\u0027\n[   65.920523] CPU: 3 PID: 1178 Comm: modprobe Tainted: G           OE      6.8.0-cleanershaderfeatureresetasdntipmi200nv2132 #13\n[   65.920525] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS WMJ0429N_Weekly_20_04_2 04/29/2020\n[   65.920527] Call Trace:\n[   65.920529]  \u003cTASK\u003e\n[   65.920532]  dump_stack_lvl+0x48/0x70\n[   65.920541]  dump_stack+0x10/0x20\n[   65.920543]  __ubsan_handle_out_of_bounds+0xa2/0xe0\n[   65.920549]  dcn21_link_encoder_create+0xd9/0x140 [amdgpu]\n[   65.921009]  link_create+0x6d3/0xed0 [amdgpu]\n[   65.921355]  create_links+0x18a/0x4e0 [amdgpu]\n[   65.921679]  dc_create+0x360/0x720 [amdgpu]\n[   65.921999]  ? dmi_matches+0xa0/0x220\n[   65.922004]  amdgpu_dm_init+0x2b6/0x2c90 [amdgpu]\n[   65.922342]  ? console_unlock+0x77/0x120\n[   65.922348]  ? dev_printk_emit+0x86/0xb0\n[   65.922354]  dm_hw_init+0x15/0x40 [amdgpu]\n[   65.922686]  amdgpu_device_init+0x26a8/0x33a0 [amdgpu]\n[   65.922921]  amdgpu_driver_load_kms+0x1b/0xa0 [amdgpu]\n[   65.923087]  amdgpu_pci_probe+0x1b7/0x630 [amdgpu]\n[   65.923087]  local_pci_probe+0x4b/0xb0\n[   65.923087]  pci_device_probe+0xc8/0x280\n[   65.923087]  really_probe+0x187/0x300\n[   65.923087]  __driver_probe_device+0x85/0x130\n[   65.923087]  driver_probe_device+0x24/0x110\n[   65.923087]  __driver_attach+0xac/0x1d0\n[   65.923087]  ? __pfx___driver_attach+0x10/0x10\n[   65.923087]  bus_for_each_dev+0x7d/0xd0\n[   65.923087]  driver_attach+0x1e/0x30\n[   65.923087]  bus_add_driver+0xf2/0x200\n[   65.923087]  driver_register+0x64/0x130\n[   65.923087]  ? __pfx_amdgpu_init+0x10/0x10 [amdgpu]\n[   65.923087]  __pci_register_driver+0x61/0x70\n[   65.923087]  amdgpu_init+0x7d/0xff0 [amdgpu]\n[   65.923087]  do_one_initcall+0x49/0x310\n[   65.923087]  ? kmalloc_trace+0x136/0x360\n[   65.923087]  do_init_module+0x6a/0x270\n[   65.923087]  load_module+0x1fce/0x23a0\n[   65.923087]  init_module_from_file+0x9c/0xe0\n[   65.923087]  ? init_module_from_file+0x9c/0xe0\n[   65.923087]  idempotent_init_module+0x179/0x230\n[   65.923087]  __x64_sys_finit_module+0x5d/0xa0\n[   65.923087]  do_syscall_64+0x76/0x120\n[   65.923087]  entry_SYSCALL_64_after_hwframe+0x6e/0x76\n[   65.923087] RIP: 0033:0x7f2d80f1e88d\n[   65.923087] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48\n[   65.923087] RSP: 002b:00007ffc7bc1aa78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139\n[   65.923087] RAX: ffffffffffffffda RBX: 0000564c9c1db130 RCX: 00007f2d80f1e88d\n[   65.923087] RDX: 0000000000000000 RSI: 0000564c9c1e5480 RDI: 000000000000000f\n[   65.923087] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000002\n[   65.923087] R10: 000000000000000f R11: 0000000000000246 R12: 0000564c9c1e5480\n[   65.923087] R13: 0000564c9c1db260 R14: 0000000000000000 R15: 0000564c9c1e54b0\n[   65.923087]  \u003c/TASK\u003e\n[   65.923927] ---[ end trace ]---"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/display: Se corrige el acceso fuera de los l\u00edmites en \u0027dcn21_link_encoder_create\u0027 Se identific\u00f3 un problema en la funci\u00f3n dcn21_link_encoder_create donde podr\u00eda ocurrir un acceso fuera de los l\u00edmites cuando se us\u00f3 el \u00edndice hpd_source para hacer referencia a la matriz link_enc_hpd_regs. Esta matriz tiene un tama\u00f1o fijo y el \u00edndice no se estaba verificando con los l\u00edmites de la matriz antes de acceder a ella. Esta correcci\u00f3n agrega una verificaci\u00f3n condicional para garantizar que el \u00edndice hpd_source est\u00e9 dentro del rango v\u00e1lido de la matriz link_enc_hpd_regs. Si el \u00edndice est\u00e1 fuera de los l\u00edmites, la funci\u00f3n ahora devuelve NULL para evitar un comportamiento indefinido. Referencias: [ 65.920507] ------------[ cortar aqu\u00ed ]------------ [ 65.920510] UBSAN: array-index-out-of-bounds en drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn21/dcn21_resource.c:1312:29 [ 65.920519] el \u00edndice 7 est\u00e1 fuera de rango para el tipo \u0027dcn10_link_enc_hpd_registers [5]\u0027 [ 65.920523] CPU: 3 PID: 1178 Comm: modprobe Tainted: G OE 6.8.0-cleanershaderfeatureresetasdntipmi200nv2132 #13 [ 65.920525] Nombre del hardware: AMD Majolica-RN/Majolica-RN, BIOS WMJ0429N_Semanal_20_04_2 29/04/2020 [ 65.920527] Seguimiento de llamadas: [ 65.920529]  [ 65.920532] dump_stack_lvl+0x48/0x70 [ 65.920541] dump_stack+0x10/0x20 [ 65.920543] __ubsan_handle_out_of_bounds+0xa2/0xe0 [ 65.920549] dcn21_link_encoder_create+0xd9/0x140 [amdgpu] [ 65.921009] link_create+0x6d3/0xed0 [amdgpu] [ 65.921355] dmi_matches+0xa0/0x220 [65.922004] amdgpu_dm_init+0x2b6/0x2c90 [amdgpu] [65.922342] ? console_unlock+0x77/0x120 [65.922348] ? dev_printk_emit+0x86/0xb0 [ 65.922354] dm_hw_init+0x15/0x40 [amdgpu] [ 65.922686] amdgpu_device_init+0x26a8/0x33a0 [amdgpu] [ 65.922921] amdgpu_driver_load_kms+0x1b/0xa0 [amdgpu] [ 65.923087] amdgpu_pci_probe+0x1b7/0x630 [amdgpu] [ 65.923087] local_pci_probe+0x4b/0xb0 [ 65.923087] pci_device_probe+0xc8/0x280 [ 65.923087] realmente_probe+0x187/0x300 [ 65.923087] __driver_probe_device+0x85/0x130 [ 65.923087] driver_probe_device+0x24/0x110 [ 65.923087] __driver_attach+0xac/0x1d0 [ 65.923087] ? __pfx___driver_attach+0x10/0x10 [ 65.923087] bus_para_cada_dispositivo+0x7d/0xd0 [ 65.923087] driver_attach+0x1e/0x30 [ 65.923087] bus_add_driver+0xf2/0x200 [ 65.923087] driver_register+0x64/0x130 [ 65.923087] ? __pfx_amdgpu_init+0x10/0x10 [amdgpu] [ 65.923087] __pci_register_driver+0x61/0x70 [ 65.923087] amdgpu_init+0x7d/0xff0 [amdgpu] [ 65.923087] hacer_una_llamada_init+0x49/0x310 [ 65.923087] ? kmalloc_trace+0x136/0x360 [ 65.923087] hacer_init_module+0x6a/0x270 [ 65.923087] cargar_m\u00f3dulo+0x1fce/0x23a0 [ 65.923087] iniciar_m\u00f3dulo_desde_archivo+0x9c/0xe0 [ 65.923087] ? m\u00f3dulo_de_inicio_desde_archivo+0x9c/0xe0 [ 65.923087] m\u00f3dulo_de_inicio_idempotente+0x179/0x230 [ 65.923087] m\u00f3dulo_de_finici\u00f3n_del_sistema_x64+0x5d/0xa0 [ 65.923087] llamada_al_sistema_64+0x76/0x120 [ 65.923087] llamada_al_sistema_64_despu\u00e9s_de_hwframe+0x6e/0x76 [ 65.923087] RIP: 0033:0x7f2d80f1e88d [ 65.923087] C\u00f3digo: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48 [ 65.923087] RSP: 002b:00007ffc7bc1aa78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 65.923087] RAX: ffffffffffffffda RBX: 0000564c9c1db130 RCX: 00007f2d80f1e88d [ 65.923087] RDX: 0000000000000000 RSI: 0000564c9c1e5480 RDI: 000000000000000f [ 65.923087] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000002 [ 65.923087] R10: 000000000000000f R11: 0000000000000246 R12: 0000564c9c1e5480 [ 65.923087] R13: 0000564c9c1db260 R14: 0000000000000000 R15: 0000564c9c1e54b0 [ 65.923087]  [ 65.923927] ---[ fin del seguimiento ]---"
          }
        ],
        "id": "CVE-2024-56608",
        "lastModified": "2026-08-04T11:22:14.260",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2024-12-27T15:15:20.283",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/08ac5fdb9c6dc34d0ed4bc64ce3c5c3d411b3b53"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/280f722601c8bf4d8a9c62dd727cf3a2fd0a47be"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5bd410c21037107b83ffbb51dd2d6460f9de9ed1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/63de35a8fcfca59ae8750d469a7eb220c7557baf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b19ca8425a4b86e8f0d7c33c4e87ef7b0ebdaa29"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f01ddd589e162979421e6914b1c74018633f01e0"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-129"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:40:20+00:00",
      "cve": "CVE-2024-56608",
      "id": "CVE-2024-56608",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amd/display: Fix out-of-bounds access in \u0027dcn21_link_encoder_create\u0027",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56608.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.