CVE-2021-47046
published 2024-02-28CVE-2021-47046: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix off by one in hdmi_14_process_transaction() The hdcp_i2c_offsets[]…
PriorityP337high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.24%
15.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix off by one in hdmi_14_process_transaction()
The hdcp_i2c_offsets[] array did not have an entry for
HDCP_MESSAGE_ID_WRITE_CONTENT_STREAM_TYPE so it led to an off by one
read overflow. I added an entry and copied the 0x0 value for the offset
from similar code in drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c.
I also declared several of these arrays as having HDCP_MESSAGE_ID_MAX
entries. This doesn't change the code, but it's just a belt and
suspenders approach to try future proof the code.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.10.38-1 (bookworm) | linux 5.10.38-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 4c283fdac08abf3211533f70623c90a34f41d08d < 403c4528e5887af3deb9838cb77a557631d1e138 | 403c4528e5887af3deb9838cb77a557631d1e138 |
| linux | linux | >= 4c283fdac08abf3211533f70623c90a34f41d08d < 6a58310d5d1e5b02d0fc9b393ba540c9367bced5 | 6a58310d5d1e5b02d0fc9b393ba540c9367bced5 |
| linux | linux | >= 4c283fdac08abf3211533f70623c90a34f41d08d < 080bd41d6478a64edf96704fddcda52b1fd5fed7 | 080bd41d6478a64edf96704fddcda52b1fd5fed7 |
| linux | linux | >= 4c283fdac08abf3211533f70623c90a34f41d08d < 8e6fafd5a22e7a2eb216f5510db7aab54cc545c1 | 8e6fafd5a22e7a2eb216f5510db7aab54cc545c1 |
| linux | linux_kernel | >= 0 < 5.10.38-1 | 5.10.38-1 |
| linux | linux_kernel | >= 0 < 5.10.38-1 | 5.10.38-1 |
| linux | linux_kernel | >= 0 < 5.10.38-1 | 5.10.38-1 |
| linux | linux_kernel | >= 0 < 5.10.38-1 | 5.10.38-1 |
| linux | linux_kernel | >= 5.11 < 5.11.21 | 5.11.21 |
| linux | linux_kernel | >= 5.12 < 5.12.4 | 5.12.4 |
| linux | linux_kernel | >= 5.5 < 5.10.37 | 5.10.37 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: drm/amd/display: Fix off by one in hdmi_14_process_transaction()
vendor_redhat·2024-02-28·CVSS 7.8
CVE-2021-47046 [HIGH] CWE-121 kernel: drm/amd/display: Fix off by one in hdmi_14_process_transaction()
kernel: drm/amd/display: Fix off by one in hdmi_14_process_transaction()
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix off by one in hdmi_14_process_transaction()
The hdcp_i2c_offsets[] array did not have an entry for
HDCP_MESSAGE_ID_WRITE_CONTENT_STREAM_TYPE so it led to an off by one
read overflow. I added an entry and copied the 0x0 value for the offset
from similar code in drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c.
I also declared several of these arrays as having HDCP_MESSAGE_ID_MAX
entries. This doesn't change the code, but it's just a belt and
suspenders approach to try future proof the code.
An off-by-one read overflow was found in the Linux kernel in the hdmi_14_process_transaction() function. This issue may lead to a crash.
Debian
CVE-2021-47046: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis...
vendor_debian·2021·CVSS 7.8
CVE-2021-47046 [HIGH] CVE-2021-47046: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis...
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix off by one in hdmi_14_process_transaction() The hdcp_i2c_offsets[] array did not have an entry for HDCP_MESSAGE_ID_WRITE_CONTENT_STREAM_TYPE so it led to an off by one read overflow. I added an entry and copied the 0x0 value for the offset from similar code in drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c. I also declared several of these arrays as having HDCP_MESSAGE_ID_MAX entries. This doesn't change the code, but it's just a belt and suspenders approach to try future proof the code.
Scope: local
bookworm: resolved (fixed in 5.10.38-1)
bullseye: resolved (fixed in 5.10.38-1)
forky: resolved (fixed in 5.10.38-1)
sid: resolved (fixed in 5.10.38-1)
trixie: resolved (fixed in 5.10.38-1)
GHSA
GHSA-2v9v-6h75-597v: In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix off by one in hdmi_14_process_transaction()
The hdcp_i2c_of
ghsa_unreviewed·2024-02-28
CVE-2021-47046 [HIGH] CWE-193 GHSA-2v9v-6h75-597v: In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix off by one in hdmi_14_process_transaction()
The hdcp_i2c_of
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix off by one in hdmi_14_process_transaction()
The hdcp_i2c_offsets[] array did not have an entry for
HDCP_MESSAGE_ID_WRITE_CONTENT_STREAM_TYPE so it led to an off by one
read overflow. I added an entry and copied the 0x0 value for the offset
from similar code in drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c.
I also declared several of these arrays as having HDCP_MESSAGE_ID_MAX
entries. This doesn't change the code, but it's just a belt and
suspenders approach to try future proof the code.
OSV
CVE-2021-47046: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix off by one in hdmi_14_process_transaction() The hdcp_i2c_offs
osv·2024-02-28·CVSS 7.8
CVE-2021-47046 [HIGH] CVE-2021-47046: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix off by one in hdmi_14_process_transaction() The hdcp_i2c_offs
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix off by one in hdmi_14_process_transaction() The hdcp_i2c_offsets[] array did not have an entry for HDCP_MESSAGE_ID_WRITE_CONTENT_STREAM_TYPE so it led to an off by one read overflow. I added an entry and copied the 0x0 value for the offset from similar code in drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c. I also declared several of these arrays as having HDCP_MESSAGE_ID_MAX entries. This doesn't change the code, but it's just a belt and suspenders approach to try future proof the code.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/080bd41d6478a64edf96704fddcda52b1fd5fed7https://git.kernel.org/stable/c/403c4528e5887af3deb9838cb77a557631d1e138https://git.kernel.org/stable/c/6a58310d5d1e5b02d0fc9b393ba540c9367bced5https://git.kernel.org/stable/c/8e6fafd5a22e7a2eb216f5510db7aab54cc545c1https://git.kernel.org/stable/c/080bd41d6478a64edf96704fddcda52b1fd5fed7https://git.kernel.org/stable/c/403c4528e5887af3deb9838cb77a557631d1e138https://git.kernel.org/stable/c/6a58310d5d1e5b02d0fc9b393ba540c9367bced5https://git.kernel.org/stable/c/8e6fafd5a22e7a2eb216f5510db7aab54cc545c1
2024-02-28
Published