Executive Summary

This vulnerability exists in the Linux kernel's AMD display driver related to HDMI HDCP 2.x repeater authentication. During this process, the driver reads a message size field from the sink's RxStatus register and uses this value to determine how much data to read into a buffer called rx_id_list. However, the message size is not properly limited to the buffer's size, allowing a malicious HDMI repeater to specify a size larger than the buffer. This causes an out-of-bounds write during the I2C read operation, potentially leading to memory corruption.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to an out-of-bounds write in kernel memory when interacting with a malicious HDMI repeater device. This memory corruption could potentially be exploited to cause system instability, crashes, or even allow an attacker to execute arbitrary code with kernel privileges, compromising the security and stability of the affected system.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by clamping the read length in the mod_hdcp_read_rx_id_list() function to the size of the rx_id_list buffer, preventing out-of-bounds writes during HDMI HDCP2 repeater authentication.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0