109 Star 72 Fork 297

src-openEuler/kernel

 / 详情

CVE-2024-39291

已完成
CVE和安全问题 拥有者
创建于  
2024-06-24 22:23

一、漏洞信息
漏洞编号:CVE-2024-39291
漏洞归属组件:kernel
漏洞归属的版本:4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
CVSS V3.0分值:
BaseScore:7.8 High
Vector:CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
漏洞简述:
In the Linux kernel, the following vulnerability has been resolved:drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode()The function gfx_v9_4_3_init_microcode in gfx_v9_4_3.c was generatingabout potential truncation of output when using the snprintf function.The issue was due to the size of the buffer ucode_prefix being toosmall to accommodate the maximum possible length of the string beingwritten into it.The string being written is amdgpu/%s_mec.bin or amdgpu/%s_rlc.bin ,where %s is replaced by the value of chip_name . The length of thisstring without the %s is 16 characters. The warning message indicatedthat chip_name could be up to 29 characters long, resulting in a totalof 45 characters, which exceeds the buffer size of 30 characters.To resolve this issue, the size of the ucode_prefix buffer has beenreduced from 30 to 15. This ensures that the maximum possible length ofthe string being written into the buffer will not exceed its size, thuspreventing potential buffer overflow and truncation issues.Fixes the below with gcc W=1:drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c: In function ‘gfx_v9_4_3_early_init’:drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] 379 | snprintf(fw_name, sizeof(fw_name), amdgpu/%s_rlc.bin , chip_name); | ^~...... 439 | r = gfx_v9_4_3_init_rlc_microcode(adev, ucode_prefix); | ~~~~~~~~~~~~drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30 379 | snprintf(fw_name, sizeof(fw_name), amdgpu/%s_rlc.bin , chip_name); | ^~~~~~~~~~~~~~drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] 413 | snprintf(fw_name, sizeof(fw_name), amdgpu/%s_mec.bin , chip_name); | ^~...... 443 | r = gfx_v9_4_3_init_cp_compute_microcode(adev, ucode_prefix); | drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30 413 | snprintf(fw_name, sizeof(fw_name), amdgpu/%s_mec.bin , chip_name); | ^~
漏洞公开时间:2024-06-24 22:15:12
漏洞创建时间:2024-06-24 22:23:53
漏洞详情参考链接:
https://nvd.nist.gov/vuln/detail/CVE-2024-39291

更多参考(点击展开)
参考来源 参考链接 来源链接
416baaa9-dc9f-4396-8d5f-8c081fb06d67 https://git.kernel.org/stable/c/19bd9537b6bc1c882df25206c15917214d8e9460
416baaa9-dc9f-4396-8d5f-8c081fb06d67 https://git.kernel.org/stable/c/acce6479e30f73ab0872e93a75aed1fb791d04ec
416baaa9-dc9f-4396-8d5f-8c081fb06d67 https://git.kernel.org/stable/c/f1b6a016dfa45cedc080d36fa5d6f22237d80e8b
suse_bugzilla http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-39291 https://bugzilla.suse.com/show_bug.cgi?id=1226934
suse_bugzilla https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-39291.mbox https://bugzilla.suse.com/show_bug.cgi?id=1226934
suse_bugzilla https://git.kernel.org/stable/c/19bd9537b6bc1c882df25206c15917214d8e9460 https://bugzilla.suse.com/show_bug.cgi?id=1226934
suse_bugzilla https://git.kernel.org/stable/c/f1b6a016dfa45cedc080d36fa5d6f22237d80e8b https://bugzilla.suse.com/show_bug.cgi?id=1226934
suse_bugzilla https://git.kernel.org/stable/c/acce6479e30f73ab0872e93a75aed1fb791d04ec https://bugzilla.suse.com/show_bug.cgi?id=1226934
suse_bugzilla https://www.cve.org/CVERecord?id=CVE-2024-39291 https://bugzilla.suse.com/show_bug.cgi?id=1226934
redhat_bugzilla https://lore.kernel.org/linux-cve-announce/2024062432-CVE-2024-39291-be2c@gregkh/T https://bugzilla.redhat.com/show_bug.cgi?id=2294223
ubuntu https://www.cve.org/CVERecord?id=CVE-2024-39291 https://ubuntu.com/security/CVE-2024-39291
ubuntu https://git.kernel.org/linus/acce6479e30f73ab0872e93a75aed1fb791d04ec (6.10-rc1) https://ubuntu.com/security/CVE-2024-39291
ubuntu https://git.kernel.org/stable/c/19bd9537b6bc1c882df25206c15917214d8e9460 https://ubuntu.com/security/CVE-2024-39291
ubuntu https://git.kernel.org/stable/c/f1b6a016dfa45cedc080d36fa5d6f22237d80e8b https://ubuntu.com/security/CVE-2024-39291
ubuntu https://git.kernel.org/stable/c/acce6479e30f73ab0872e93a75aed1fb791d04ec https://ubuntu.com/security/CVE-2024-39291
ubuntu https://nvd.nist.gov/vuln/detail/CVE-2024-39291 https://ubuntu.com/security/CVE-2024-39291
ubuntu https://launchpad.net/bugs/cve/CVE-2024-39291 https://ubuntu.com/security/CVE-2024-39291
ubuntu https://security-tracker.debian.org/tracker/CVE-2024-39291 https://ubuntu.com/security/CVE-2024-39291
debian https://security-tracker.debian.org/tracker/CVE-2024-39291
cve_search https://git.kernel.org/stable/c/19bd9537b6bc1c882df25206c15917214d8e9460
cve_search https://git.kernel.org/stable/c/f1b6a016dfa45cedc080d36fa5d6f22237d80e8b
cve_search https://git.kernel.org/stable/c/acce6479e30f73ab0872e93a75aed1fb791d04ec
416baaa9-dc9f-4396-8d5f-8c081fb06d67 https://git.kernel.org/stable/c/19bd9537b6bc1c882df25206c15917214d8e9460
416baaa9-dc9f-4396-8d5f-8c081fb06d67 https://git.kernel.org/stable/c/acce6479e30f73ab0872e93a75aed1fb791d04ec
416baaa9-dc9f-4396-8d5f-8c081fb06d67 https://git.kernel.org/stable/c/f1b6a016dfa45cedc080d36fa5d6f22237d80e8b

漏洞分析指导链接:
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息:

详情(点击展开)
影响的包 修复版本 修复补丁 问题引入补丁 来源
https://git.kernel.org/stable/c/19bd9537b6bc1c882df25206c15917214d8e9460 nvd
https://git.kernel.org/stable/c/acce6479e30f73ab0872e93a75aed1fb791d04ec nvd
https://git.kernel.org/stable/c/f1b6a016dfa45cedc080d36fa5d6f22237d80e8b nvd
linux https://git.kernel.org/linus/acce6479e30f73ab0872e93a75aed1fb791d04ec https://git.kernel.org/linus/86301129698be52f8398f92ea8564168f6bfcae1 ubuntu

二、漏洞分析结构反馈
影响性分析说明:
In the Linux kernel, the following vulnerability has been resolved:drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode()The function gfx_v9_4_3_init_microcode in gfx_v9_4_3.c was generatingabout potential truncation of output when using the snprintf function.The issue was due to the size of the buffer ucode_prefix being toosmall to accommodate the maximum possible length of the string beingwritten into it.The string being written is amdgpu/%s_mec.bin or amdgpu/%s_rlc.bin ,where %s is replaced by the value of chip_name . The length of thisstring without the %s is 16 characters. The warning message indicatedthat chip_name could be up to 29 characters long, resulting in a totalof 45 characters, which exceeds the buffer size of 30 characters.To resolve this issue, the size of the ucode_prefix buffer has beenreduced from 30 to 15. This ensures that the maximum possible length ofthe string being written into the buffer will not exceed its size, thuspreventing potential buffer overflow and truncation issues.Fixes the below with gcc W=1:drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c: In function ‘gfx_v9_4_3_early_init’:drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] 379 | snprintf(fw_name, sizeof(fw_name), amdgpu/%s_rlc.bin , chip_name); | ^~...... 439 | r = gfx_v9_4_3_init_rlc_microcode(adev, ucode_prefix); | ~~~~~~~~~~~~drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30 379 | snprintf(fw_name, sizeof(fw_name), amdgpu/%s_rlc.bin , chip_name); | ^~~~~~~~~~~~~~drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=] 413 | snprintf(fw_name, sizeof(fw_name), amdgpu/%s_mec.bin , chip_name); | ^~...... 443 | r = gfx_v9_4_3_init_cp_compute_microcode(adev, ucode_prefix); | drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30 413 | snprintf(fw_name, sizeof(fw_name), amdgpu/%s_mec.bin , chip_name); | ^~
openEuler评分:
7.8
Vector:CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
受影响版本排查(受影响/不受影响):
1.openEuler-24.03-LTS(6.6.0):不受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP1(5.10.0):不受影响
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响
6.master(6.1.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否):
1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.1.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

评论 (9)

openeuler-ci-bot 创建了CVE和安全问题 10个月前
openeuler-ci-bot 添加了
 
CVE/UNFIXED
标签
10个月前
展开全部操作日志

Hi openeuler-ci-bot, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here.
If you have any questions, please contact the SIG: Kernel, and any of the maintainers.

openeuler-ci-bot 添加了
 
sig/Kernel
标签
10个月前
参考网址 关联pr 状态 补丁链接
https://nvd.nist.gov/vuln/detail/CVE-2024-39291NoneNonehttps://git.kernel.org/stable/c/acce6479e30f73ab0872e93a75aed1fb791d04ec
https://git.kernel.org/stable/c/19bd9537b6bc1c882df25206c15917214d8e9460
https://git.kernel.org/stable/c/f1b6a016dfa45cedc080d36fa5d6f22237d80e8b
https://ubuntu.com/security/CVE-2024-39291NoneNonehttps://discourse.ubuntu.com/c/ubuntu-pro
https://www.opencve.io/cve/CVE-2024-39291NoneNonehttps://git.kernel.org/stable/c/acce6479e30f73ab0872e93a75aed1fb791d04ec
https://git.kernel.org/stable/c/19bd9537b6bc1c882df25206c15917214d8e9460
https://git.kernel.org/stable/c/f1b6a016dfa45cedc080d36fa5d6f22237d80e8b
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2024-39291
https://security-tracker.debian.org/tracker/CVE-2024-39291

说明:补丁链接仅供初步排查参考,实际可用性请人工再次确认,补丁下载验证可使用CVE补丁工具
若补丁不准确,烦请在此issue下评论 '/report-patch 参考网址 补丁链接1,补丁链接2' 反馈正确信息,便于我们不断优化工具,不胜感激。
如 /report-patch https://security-tracker.debian.org/tracker/CVE-2021-3997 https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1

openeuler-ci-bot 修改了描述 10个月前
openeuler-ci-bot 修改了描述 10个月前
openeuler-ci-bot 修改了描述 10个月前
openeuler-ci-bot 修改了描述 10个月前
openeuler-ci-bot 修改了描述 10个月前
openeuler-ci-bot 修改了描述 10个月前
openeuler-ci-bot 修改了描述 10个月前
openeuler-ci-bot 修改了描述 10个月前
openeuler-ci-bot 计划开始日期设置为2024-06-27 10个月前
openeuler-ci-bot 计划截止日期设置为2024-07-11 10个月前
openeuler-ci-bot 优先级设置为主要 10个月前
openeuler-ci-bot 修改了描述 10个月前
openeuler-ci-bot 修改了描述 10个月前
openeuler-ci-bot 修改了描述 10个月前
openeuler-ci-bot 修改了描述 10个月前
openeuler-ci-bot 负责人设置为sanglipeng 10个月前
openeuler-ci-bot 修改了描述 10个月前
openeuler-ci-bot 修改了描述 10个月前

CVE-2024-39291

影响性分析说明:
In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode()

The function gfx_v9_4_3_init_microcode in gfx_v9_4_3.c was generating
about potential truncation of output when using the snprintf function.
The issue was due to the size of the buffer 'ucode_prefix' being too
small to accommodate the maximum possible length of the string being
written into it.

The string being written is "amdgpu/%s_mec.bin" or "amdgpu/%s_rlc.bin",
where %s is replaced by the value of 'chip_name'. The length of this
string without the %s is 16 characters. The warning message indicated
that 'chip_name' could be up to 29 characters long, resulting in a total
of 45 characters, which exceeds the buffer size of 30 characters.

To resolve this issue, the size of the 'ucode_prefix' buffer has been
reduced from 30 to 15. This ensures that the maximum possible length of
the string being written into the buffer will not exceed its size, thus
preventing potential buffer overflow and truncation issues.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c: In function ‘gfx_v9_4_3_early_init’:
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=]
379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", chip_name);
| ^~
......
439 | r = gfx_v9_4_3_init_rlc_microcode(adev, ucode_prefix);
| ~~~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30
379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", chip_name);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=]
413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name);
| ^~
......
443 | r = gfx_v9_4_3_init_cp_compute_microcode(adev, ucode_prefix);
| ~~~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30
413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

openEuler评分:(评分和向量)
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:不受影响
2.openEuler-22.03-LTS-SP1:不受影响
3.openEuler-22.03-LTS-SP3:不受影响
4.openEuler-22.03-LTS-SP4:不受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS:受影响
7.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否):
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master(6.1.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

===========================================================

openeuler-ci-bot 修改了描述 10个月前
openeuler-ci-bot 修改了描述 10个月前

受影响版本排查(受影响/不受影响):
1.openEuler-24.03-LTS(6.6.0):不受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP1(5.10.0):不受影响
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响
6.master(6.1.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

openeuler-ci-bot 修改了描述 10个月前
郭梦琪 任务状态待办的 修改为已完成 10个月前
openeuler-ci-bot 移除了
 
CVE/UNFIXED
标签
10个月前
openeuler-ci-bot 移除了
 
sig/Kernel
标签
10个月前
openeuler-ci-bot 添加了
 
CVE/UNAFFECTED
标签
10个月前
openeuler-ci-bot 添加了
 
sig/Kernel
标签
10个月前

CVE-2024-39291

影响性分析说明:
In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode()

The function gfx_v9_4_3_init_microcode in gfx_v9_4_3.c was generating
about potential truncation of output when using the snprintf function.
The issue was due to the size of the buffer 'ucode_prefix' being too
small to accommodate the maximum possible length of the string being
written into it.

The string being written is "amdgpu/%s_mec.bin" or "amdgpu/%s_rlc.bin",
where %s is replaced by the value of 'chip_name'. The length of this
string without the %s is 16 characters. The warning message indicated
that 'chip_name' could be up to 29 characters long, resulting in a total
of 45 characters, which exceeds the buffer size of 30 characters.

To resolve this issue, the size of the 'ucode_prefix' buffer has been
reduced from 30 to 15. This ensures that the maximum possible length of
the string being written into the buffer will not exceed its size, thus
preventing potential buffer overflow and truncation issues.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c: In function ‘gfx_v9_4_3_early_init’:
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=]
379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", chip_name);
| ^~
......
439 | r = gfx_v9_4_3_init_rlc_microcode(adev, ucode_prefix);
| ~~~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30
379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", chip_name);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=]
413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name);
| ^~
......
443 | r = gfx_v9_4_3_init_cp_compute_microcode(adev, ucode_prefix);
| ~~~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30
413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The Linux kernel CVE team has assigned CVE-2024-39291 to this issue.

openEuler评分:(评分和向量)
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:不受影响
2.openEuler-22.03-LTS-SP1:不受影响
3.openEuler-22.03-LTS-SP3:不受影响
4.openEuler-22.03-LTS-SP4:不受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS:受影响
7.openEuler-24.03-LTS-Next:受影响

修复是否涉及abi变化(是/否):
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master(6.1.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

CVE-2024-39291

影响性分析说明:
In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode()

The function gfx_v9_4_3_init_microcode in gfx_v9_4_3.c was generating
about potential truncation of output when using the snprintf function.
The issue was due to the size of the buffer 'ucode_prefix' being too
small to accommodate the maximum possible length of the string being
written into it.

The string being written is "amdgpu/%s_mec.bin" or "amdgpu/%s_rlc.bin",
where %s is replaced by the value of 'chip_name'. The length of this
string without the %s is 16 characters. The warning message indicated
that 'chip_name' could be up to 29 characters long, resulting in a total
of 45 characters, which exceeds the buffer size of 30 characters.

To resolve this issue, the size of the 'ucode_prefix' buffer has been
reduced from 30 to 15. This ensures that the maximum possible length of
the string being written into the buffer will not exceed its size, thus
preventing potential buffer overflow and truncation issues.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c: In function ‘gfx_v9_4_3_early_init’:
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=]
379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", chip_name);
| ^~
......
439 | r = gfx_v9_4_3_init_rlc_microcode(adev, ucode_prefix);
| ~~~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30
379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", chip_name);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=]
413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name);
| ^~
......
443 | r = gfx_v9_4_3_init_cp_compute_microcode(adev, ucode_prefix);
| ~~~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30
413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The Linux kernel CVE team has assigned CVE-2024-39291 to this issue.

openEuler评分:(评分和向量)
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:不受影响
2.openEuler-22.03-LTS-SP1:不受影响
3.openEuler-22.03-LTS-SP3:不受影响
4.openEuler-22.03-LTS-SP4:不受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS:受影响
7.openEuler-24.03-LTS-Next:受影响

修复是否涉及abi变化(是/否):
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master(6.1.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

CVE-2024-39291

影响性分析说明:
In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode()

The function gfx_v9_4_3_init_microcode in gfx_v9_4_3.c was generating
about potential truncation of output when using the snprintf function.
The issue was due to the size of the buffer 'ucode_prefix' being too
small to accommodate the maximum possible length of the string being
written into it.

The string being written is "amdgpu/%s_mec.bin" or "amdgpu/%s_rlc.bin",
where %s is replaced by the value of 'chip_name'. The length of this
string without the %s is 16 characters. The warning message indicated
that 'chip_name' could be up to 29 characters long, resulting in a total
of 45 characters, which exceeds the buffer size of 30 characters.

To resolve this issue, the size of the 'ucode_prefix' buffer has been
reduced from 30 to 15. This ensures that the maximum possible length of
the string being written into the buffer will not exceed its size, thus
preventing potential buffer overflow and truncation issues.

Fixes the below with gcc W=1:
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c: In function ‘gfx_v9_4_3_early_init’:
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=]
379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", chip_name);
| ^~
......
439 | r = gfx_v9_4_3_init_rlc_microcode(adev, ucode_prefix);
| ~~~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:379:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30
379 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_rlc.bin", chip_name);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:52: warning: ‘%s’ directive output may be truncated writing up to 29 bytes into a region of size 23 [-Wformat-truncation=]
413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name);
| ^~
......
443 | r = gfx_v9_4_3_init_cp_compute_microcode(adev, ucode_prefix);
| ~~~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c:413:9: note: ‘snprintf’ output between 16 and 45 bytes into a destination of size 30
413 | snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_mec.bin", chip_name);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The Linux kernel CVE team has assigned CVE-2024-39291 to this issue.

openEuler评分:(评分和向量)
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

受影响版本排查(受影响/不受影响):
1.openEuler-20.03-LTS-SP4:不受影响
2.openEuler-22.03-LTS-SP1:不受影响
3.openEuler-22.03-LTS-SP3:不受影响
4.openEuler-22.03-LTS-SP4:不受影响
5.master(6.1.0):不受影响
6.openEuler-24.03-LTS:受影响
7.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否):
1.openEuler-20.03-LTS-SP4:否
2.openEuler-22.03-LTS-SP1:否
3.openEuler-22.03-LTS-SP3:否
4.master(6.1.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-22.03-LTS-SP4:否

登录 后才可以发表评论

状态
负责人
项目
Pull Requests
关联的 Pull Requests 被合并后可能会关闭此 issue
预计工期 (小时)
开始日期   -   截止日期
-
置顶选项
优先级
分支
参与者(3)
5329419 openeuler ci bot 1632792936 郭梦琪-guo-mengqi hulk-robot-zhixiuzhou
1
https://gitee.com/src-openeuler/kernel.git
git@gitee.com:src-openeuler/kernel.git
src-openeuler
kernel
kernel

搜索帮助