cve-2024-26721
Vulnerability from cvelistv5
Published
2024-04-03 14:55
Modified
2024-12-19 08:45
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/i915/dsc: Fix the macro that calculates DSCC_/DSCA_ PPS reg address Commit bd077259d0a9 ("drm/i915/vdsc: Add function to read any PPS register") defines a new macro to calculate the DSC PPS register addresses with PPS number as an input. This macro correctly calculates the addresses till PPS 11 since the addresses increment by 4. So in that case the following macro works correctly to give correct register address: _MMIO(_DSCA_PPS_0 + (pps) * 4) However after PPS 11, the register address for PPS 12 increments by 12 because of RC Buffer memory allocation in between. Because of this discontinuity in the address space, the macro calculates wrong addresses for PPS 12 - 16 resulting into incorrect DSC PPS parameter value read/writes causing DSC corruption. This fixes it by correcting this macro to add the offset of 12 for PPS >=12. v3: Add correct paranthesis for pps argument (Jani Nikula) (cherry picked from commit 6074be620c31dc2ae11af96a1a5ea95580976fb5)
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/962ac2dce56bb3aad1f82a4bbe3ada57a020287cPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ff5999fb03f467e1e7159f0ddb199c787f7512b9Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/962ac2dce56bb3aad1f82a4bbe3ada57a020287cPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/ff5999fb03f467e1e7159f0ddb199c787f7512b9Patch
Impacted products
Vendor Product Version
Linux Linux Version: bd077259d0a9c9bf453e7e9751bf41f1996e6585
Version: bd077259d0a9c9bf453e7e9751bf41f1996e6585
 Create a notification for this product.
   Linux Linux Version: 6.7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T00:14:13.016Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/ff5999fb03f467e1e7159f0ddb199c787f7512b9",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/962ac2dce56bb3aad1f82a4bbe3ada57a020287c",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-26721",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-10T15:52:16.898186Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-11T17:32:52.594Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "drivers/gpu/drm/i915/display/intel_vdsc_regs.h",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "ff5999fb03f467e1e7159f0ddb199c787f7512b9",
                     status: "affected",
                     version: "bd077259d0a9c9bf453e7e9751bf41f1996e6585",
                     versionType: "git",
                  },
                  {
                     lessThan: "962ac2dce56bb3aad1f82a4bbe3ada57a020287c",
                     status: "affected",
                     version: "bd077259d0a9c9bf453e7e9751bf41f1996e6585",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "drivers/gpu/drm/i915/display/intel_vdsc_regs.h",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "6.7",
                  },
                  {
                     lessThan: "6.7",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.7.*",
                     status: "unaffected",
                     version: "6.7.6",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.8",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/dsc: Fix the macro that calculates DSCC_/DSCA_ PPS reg address\n\nCommit bd077259d0a9 (\"drm/i915/vdsc: Add function to read any PPS\nregister\") defines a new macro to calculate the DSC PPS register\naddresses with PPS number as an input. This macro correctly calculates\nthe addresses till PPS 11 since the addresses increment by 4. So in that\ncase the following macro works correctly to give correct register\naddress:\n\n_MMIO(_DSCA_PPS_0 + (pps) * 4)\n\nHowever after PPS 11, the register address for PPS 12 increments by 12\nbecause of RC Buffer memory allocation in between. Because of this\ndiscontinuity in the address space, the macro calculates wrong addresses\nfor PPS 12 - 16 resulting into incorrect DSC PPS parameter value\nread/writes causing DSC corruption.\n\nThis fixes it by correcting this macro to add the offset of 12 for PPS\n>=12.\n\nv3: Add correct paranthesis for pps argument (Jani Nikula)\n\n(cherry picked from commit 6074be620c31dc2ae11af96a1a5ea95580976fb5)",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-12-19T08:45:50.831Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/ff5999fb03f467e1e7159f0ddb199c787f7512b9",
            },
            {
               url: "https://git.kernel.org/stable/c/962ac2dce56bb3aad1f82a4bbe3ada57a020287c",
            },
         ],
         title: "drm/i915/dsc: Fix the macro that calculates DSCC_/DSCA_ PPS reg address",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2024-26721",
      datePublished: "2024-04-03T14:55:20.995Z",
      dateReserved: "2024-02-19T14:20:24.162Z",
      dateUpdated: "2024-12-19T08:45:50.831Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-26721\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-03T15:15:54.043\",\"lastModified\":\"2025-03-17T16:01:40.143\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/i915/dsc: Fix the macro that calculates DSCC_/DSCA_ PPS reg address\\n\\nCommit bd077259d0a9 (\\\"drm/i915/vdsc: Add function to read any PPS\\nregister\\\") defines a new macro to calculate the DSC PPS register\\naddresses with PPS number as an input. This macro correctly calculates\\nthe addresses till PPS 11 since the addresses increment by 4. So in that\\ncase the following macro works correctly to give correct register\\naddress:\\n\\n_MMIO(_DSCA_PPS_0 + (pps) * 4)\\n\\nHowever after PPS 11, the register address for PPS 12 increments by 12\\nbecause of RC Buffer memory allocation in between. Because of this\\ndiscontinuity in the address space, the macro calculates wrong addresses\\nfor PPS 12 - 16 resulting into incorrect DSC PPS parameter value\\nread/writes causing DSC corruption.\\n\\nThis fixes it by correcting this macro to add the offset of 12 for PPS\\n>=12.\\n\\nv3: Add correct paranthesis for pps argument (Jani Nikula)\\n\\n(cherry picked from commit 6074be620c31dc2ae11af96a1a5ea95580976fb5)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: drm/i915/dsc: corrige la macro que calcula la dirección de registro DSCC_/DSCA_ PPS Commit bd077259d0a9 (\\\"drm/i915/vdsc: Agregar función para leer cualquier registro PPS\\\") define un Nueva macro para calcular las direcciones de registro DSC PPS con el número PPS como entrada. Esta macro calcula correctamente las direcciones hasta PPS 11 ya que las direcciones se incrementan en 4. Entonces, en ese caso, la siguiente macro funciona correctamente para proporcionar la dirección de registro correcta: _MMIO(_DSCA_PPS_0 + (pps) * 4) Sin embargo, después de PPS 11, la dirección de registro para PPS 12 se incrementa en 12 debido a la asignación de memoria del búfer RC en el medio. Debido a esta discontinuidad en el espacio de direcciones, la macro calcula direcciones incorrectas para PPS 12 - 16, lo que genera lecturas/escrituras incorrectas del valor del parámetro PPS de DSC, lo que provoca corrupción de DSC. Esto se soluciona corrigiendo esta macro para agregar el desplazamiento de 12 para PPS >=12. v3: agregue paréntesis correcto para el argumento pps (Jani Nikula) (seleccionado del commit 6074be620c31dc2ae11af96a1a5ea95580976fb5)\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-131\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.6\",\"matchCriteriaId\":\"C6D6A5C8-7308-42A9-8A72-ABF3DEA4BB82\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"62075ACE-B2A0-4B16-829D-B3DA5AE5CC41\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/962ac2dce56bb3aad1f82a4bbe3ada57a020287c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ff5999fb03f467e1e7159f0ddb199c787f7512b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/962ac2dce56bb3aad1f82a4bbe3ada57a020287c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ff5999fb03f467e1e7159f0ddb199c787f7512b9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ff5999fb03f467e1e7159f0ddb199c787f7512b9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/962ac2dce56bb3aad1f82a4bbe3ada57a020287c\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.016Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26721\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:52:16.898186Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:13.194Z\"}}], \"cna\": {\"title\": \"drm/i915/dsc: Fix the macro that calculates DSCC_/DSCA_ PPS reg address\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"bd077259d0a9c9bf453e7e9751bf41f1996e6585\", \"lessThan\": \"ff5999fb03f467e1e7159f0ddb199c787f7512b9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bd077259d0a9c9bf453e7e9751bf41f1996e6585\", \"lessThan\": \"962ac2dce56bb3aad1f82a4bbe3ada57a020287c\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/i915/display/intel_vdsc_regs.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.7.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/i915/display/intel_vdsc_regs.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ff5999fb03f467e1e7159f0ddb199c787f7512b9\"}, {\"url\": \"https://git.kernel.org/stable/c/962ac2dce56bb3aad1f82a4bbe3ada57a020287c\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/i915/dsc: Fix the macro that calculates DSCC_/DSCA_ PPS reg address\\n\\nCommit bd077259d0a9 (\\\"drm/i915/vdsc: Add function to read any PPS\\nregister\\\") defines a new macro to calculate the DSC PPS register\\naddresses with PPS number as an input. This macro correctly calculates\\nthe addresses till PPS 11 since the addresses increment by 4. So in that\\ncase the following macro works correctly to give correct register\\naddress:\\n\\n_MMIO(_DSCA_PPS_0 + (pps) * 4)\\n\\nHowever after PPS 11, the register address for PPS 12 increments by 12\\nbecause of RC Buffer memory allocation in between. Because of this\\ndiscontinuity in the address space, the macro calculates wrong addresses\\nfor PPS 12 - 16 resulting into incorrect DSC PPS parameter value\\nread/writes causing DSC corruption.\\n\\nThis fixes it by correcting this macro to add the offset of 12 for PPS\\n>=12.\\n\\nv3: Add correct paranthesis for pps argument (Jani Nikula)\\n\\n(cherry picked from commit 6074be620c31dc2ae11af96a1a5ea95580976fb5)\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T08:45:50.831Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-26721\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T08:45:50.831Z\", \"dateReserved\": \"2024-02-19T14:20:24.162Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-03T14:55:20.995Z\", \"assignerShortName\": \"Linux\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.