Heap Overflow in AMD Display Driver via krealloc_array()

Executive Summary

This vulnerability exists in the Linux kernel's drm/amd/display component, specifically in the dal_vector_reserve() function.

The function calculates the allocation size using uint32_t arithmetic as "capacity * vector->struct_size". If this calculation overflows, it silently wraps around to a smaller value.

As a result, the krealloc() function allocates a smaller buffer than intended, which can lead to heap overflows when the vector is appended to later.

The fix replaces krealloc() with krealloc_array(), which includes an internal overflow check and returns NULL if an overflow occurs, preventing the heap overflow issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to heap overflows in the Linux kernel's AMD display driver.

Heap overflows can cause memory corruption, which may result in system instability, crashes, or potentially allow an attacker to execute arbitrary code with kernel privileges.

Such impacts can compromise the security and reliability of systems running the affected Linux kernel.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability in the Linux kernel's drm/amd/display component has been resolved by replacing krealloc() with krealloc_array() in the dal_vector_reserve() function to prevent heap overflows caused by integer overflow.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0