Input validation error in Linux kernel dc gpio driver

1) Input validation error

EUVDB-ID: #VU97842

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46818

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the is_pin_busy(), set_pin_busy(), set_pin_free(), dal_gpio_service_lock() and dal_gpio_service_unlock() functions in drivers/gpu/drm/amd/display/dc/gpio/gpio_service.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

External links

http://git.kernel.org/stable/c/8520fdc8ecc38f240a8e9e7af89cca6739c3e790
http://git.kernel.org/stable/c/40c2e8bc117cab8bca8814735f28a8b121654a84
http://git.kernel.org/stable/c/0184cca30cad74d88f5c875d4e26999e26325700
http://git.kernel.org/stable/c/276e3fd93e3beb5894eb1cc8480f9f417d51524d
http://git.kernel.org/stable/c/08e7755f754e3d2cef7d3a7da538d33526bd6f7c
http://git.kernel.org/stable/c/3d4198ab612ad48f73383ad3bb5663e6f0cdf406
http://git.kernel.org/stable/c/2a5626eeb3b5eec7a36886f9556113dd93ec8ed6

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.