CVE-2022-50079 (GCVE-0-2022-50079)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:02 – Updated: 2026-08-05 08:57
VLAI
Title
drm/amd/display: Check correct bounds for stream encoder instances for DCN303
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check correct bounds for stream encoder instances for DCN303 [Why & How] eng_id for DCN303 cannot be more than 1, since we have only two instances of stream encoders. Check the correct boundary condition for engine ID for DCN303 prevent the potential out of bounds access.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: cd6d421e3d1ad5926b74091254e345db730e7706 , < 82a27c1855445d48aacc67b0c0640f3dadebe52f (git)
Affected: cd6d421e3d1ad5926b74091254e345db730e7706 , < 4c31dca1799612eb3b6413e3e574f90c3fb8f865 (git)
Affected: cd6d421e3d1ad5926b74091254e345db730e7706 , < 89b008222c2bf21e50219725caed31590edfd9d1 (git)
Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.63 , ≤ 5.15.* (semver)
Unaffected: 5.19.4 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/dcn303/dcn303_resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "82a27c1855445d48aacc67b0c0640f3dadebe52f",
              "status": "affected",
              "version": "cd6d421e3d1ad5926b74091254e345db730e7706",
              "versionType": "git"
            },
            {
              "lessThan": "4c31dca1799612eb3b6413e3e574f90c3fb8f865",
              "status": "affected",
              "version": "cd6d421e3d1ad5926b74091254e345db730e7706",
              "versionType": "git"
            },
            {
              "lessThan": "89b008222c2bf21e50219725caed31590edfd9d1",
              "status": "affected",
              "version": "cd6d421e3d1ad5926b74091254e345db730e7706",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/dcn303/dcn303_resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.63",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.4",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check correct bounds for stream encoder instances for DCN303\n\n[Why \u0026 How]\neng_id for DCN303 cannot be more than 1, since we have only two\ninstances of stream encoders.\n\nCheck the correct boundary condition for engine ID for DCN303 prevent\nthe potential out of bounds access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in amdgpu display-core resource construction (`amdgpu_dm_init` \u2192 `dc_create` \u2192 `dcn303_resource_construct` \u2192 `resource_construct` \u2192 `dcn303_stream_encoder_create`), reachable only during local GPU probe/module load with no network or physical-bus path.\nAC:H - Reaching an out-of-bounds `eng_id` requires a value \u2265 2, but the sole caller loops `i \u003c res_cap_dcn303.num_stream_encoder` where that count is a compile-time constant of 2 that no code path modifies \u2014 the required condition is entirely outside any attacker\u0027s influence.\nPR:L - The code runs during driver probe at boot or module load rather than via an unprivileged ioctl; scoring the more severe arguable option (probe/autoload reachable to a low-privileged local user on a Beige Goby system) rather than requiring full root.\nUI:N - Resource-pool construction happens automatically during amdgpu initialization with no victim action such as mounting a filesystem or opening a file.\nS:U - Any resulting corruption stays within the kernel\u0027s own security authority on the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - An out-of-bounds read past `stream_enc_regs[]` yields values stored as MMIO register offsets, so encoder helpers would read arbitrary GPU registers outside the intended DIO block, exposing device and potentially framebuffer/engine state.\nI:H - The same bogus offsets are used for `REG_UPDATE`/`REG_SET` writes, enabling writes to unintended GPU registers in the aperture and corrupting display-engine state on a DMA-capable device that on APUs shares system memory.\nA:H - Programming a stream encoder through a garbage register-offset table would misprogram or hang the GPU display pipeline and can oops the driver, causing full availability loss for graphics and potentially the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:57:20.643Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/82a27c1855445d48aacc67b0c0640f3dadebe52f"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c31dca1799612eb3b6413e3e574f90c3fb8f865"
        },
        {
          "url": "https://git.kernel.org/stable/c/89b008222c2bf21e50219725caed31590edfd9d1"
        }
      ],
      "title": "drm/amd/display: Check correct bounds for stream encoder instances for DCN303",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50079",
    "datePublished": "2025-06-18T11:02:22.235Z",
    "dateReserved": "2025-06-18T10:57:27.409Z",
    "dateUpdated": "2026-08-05T08:57:20.643Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50079",
      "date": "2026-08-06",
      "epss": "0.00224",
      "percentile": "0.13142"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50079\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T11:15:36.873\",\"lastModified\":\"2026-08-04T10:18:04.500\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: Check correct bounds for stream encoder instances for DCN303\\n\\n[Why \u0026 How]\\neng_id for DCN303 cannot be more than 1, since we have only two\\ninstances of stream encoders.\\n\\nCheck the correct boundary condition for engine ID for DCN303 prevent\\nthe potential out of bounds access.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/display: Verificar los l\u00edmites correctos para las instancias del codificador de flujo para DCN303 [Por qu\u00e9 y c\u00f3mo] El valor eng_id para DCN303 no puede ser mayor que 1, ya que solo tenemos dos instancias de codificadores de flujo. Verificar la condici\u00f3n de l\u00edmite correcta para el ID del motor para DCN303 previene el posible acceso fuera de los l\u00edmites.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/display/dc/dcn303/dcn303_resource.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cd6d421e3d1ad5926b74091254e345db730e7706\",\"lessThan\":\"82a27c1855445d48aacc67b0c0640f3dadebe52f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cd6d421e3d1ad5926b74091254e345db730e7706\",\"lessThan\":\"4c31dca1799612eb3b6413e3e574f90c3fb8f865\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cd6d421e3d1ad5926b74091254e345db730e7706\",\"lessThan\":\"89b008222c2bf21e50219725caed31590edfd9d1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/display/dc/dcn303/dcn303_resource.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.63\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19.4\",\"lessThanOrEqual\":\"5.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14\",\"versionEndExcluding\":\"5.15.63\",\"matchCriteriaId\":\"185EE6AF-BD8F-4E95-80BC-9322B04CC91B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.19.4\",\"matchCriteriaId\":\"0E669300-DA42-4ACD-86D8-68BE5F29FB88\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8BD11A3-8643-49B6-BADE-5029A0117325\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4c31dca1799612eb3b6413e3e574f90c3fb8f865\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/82a27c1855445d48aacc67b0c0640f3dadebe52f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/89b008222c2bf21e50219725caed31590edfd9d1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T03:48:13+00:00",
      "cve": "CVE-2022-50079",
      "id": "CVE-2022-50079",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "321",
      "product_status:known_affected": "38",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amd/display: Check correct bounds for stream encoder instances for DCN303",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50079.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:11:40Z",
      "cve": "CVE-2022-50079",
      "id": "CVE-2022-50079",
      "initial_release_date": "2025-06-19T03:42:27Z",
      "product_status:known_affected": "344",
      "product_status:known_not_affected": "298",
      "product_status:recommended": "253",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50079",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50079.json",
      "version": "40"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.