CVE-2022-48979

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-48979", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-22T01:27:53.632Z", "datePublished": "2024-10-21T20:05:57.707Z", "dateUpdated": "2026-08-12T23:57:22.747Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-12T23:57:22.747Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix array index out of bound error in DCN32 DML\n\n[Why&How]\nLinkCapacitySupport array is indexed with the number of voltage states and\nnot the number of max DPPs. Fix the error by changing the array\ndeclaration to use the correct (larger) array size of total number of\nvoltage states."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached via DRM atomic modesetting (DRM_IOCTL_MODE_ATOMIC) into amdgpu_dm validation and DCN32 DML (dml32_ModeSupportAndSystemConfigurationFull); exploitation requires local access to the DRM device, not network or adjacent-network reachability.\nAC:L - On affected DCN32 hardware, synthetic/legacy SOC state construction routinely builds more than DC__NUM_DPP__MAX (8) voltage states (up to DC__VOLTAGE_STATES=20), so mode validation reliably indexes past the undersized LinkCapacitySupport array with no race or attacker-uncontrollable condition.\nPR:L - Triggering requires DRM master for atomic modeset, which an unprivileged local user with seat/video access can obtain (first opener of the primary node becomes master without CAP_SYS_ADMIN; compositors also run as the logged-in user), matching other amd/display OOB scores.\nUI:N - The attacker initiates the modeset/ioctl themselves; no separate victim action is required.\nS:U - Impact is confined to kernel memory within the same host security authority (standard local kernel memory corruption / privilege-escalation scope), with no VM escape or IOMMU boundary crossing.\nC:H - Out-of-bounds indexing of LinkCapacitySupport both writes past the array into adjacent vba_vars_st fields and reads those adjacent bytes as mode-support flags; kernel memory corruption of this class is treated as enabling high confidentiality impact.\nI:H - The bug is an out-of-bounds write of bool values into neighboring DML state (VREADY_AT_OR_AFTER_VSYNC, MIN_DST_Y_NEXT_START, and beyond), which is kernel memory corruption usable for integrity impact and control-flow/state corruption.\nA:H - Corrupting adjacent mode-programming state can cause kernel oops/panic or otherwise fatal misbehavior during display bandwidth validation and subsequent programming."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h"], "versions": [{"version": "74458c081fcfb0423877e630de2746daefdb16e4", "lessThan": "3d8a298b2e83b98042e6ec726e934f535b23e6aa", "status": "affected", "versionType": "git"}, {"version": "74458c081fcfb0423877e630de2746daefdb16e4", "lessThan": "aeffc8fb2174f017a10df114bc312f899904dc68", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h"], "versions": [{"version": "5.14", "status": "affected"}, {"version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.0.13", "lessThanOrEqual": "6.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.0.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3d8a298b2e83b98042e6ec726e934f535b23e6aa"}, {"url": "https://git.kernel.org/stable/c/aeffc8fb2174f017a10df114bc312f899904dc68"}], "title": "drm/amd/display: fix array index out of bound error in DCN32 DML", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48979", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-22T13:18:06.288121Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:18:44.044Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48979", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-22T13:18:06.288121Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:18:09.448Z"}}], "cna": {"title": "drm/amd/display: fix array index out of bound error in DCN32 DML", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached via DRM atomic modesetting (DRM_IOCTL_MODE_ATOMIC) into amdgpu_dm validation and DCN32 DML (dml32_ModeSupportAndSystemConfigurationFull); exploitation requires local access to the DRM device, not network or adjacent-network reachability.\nAC:L - On affected DCN32 hardware, synthetic/legacy SOC state construction routinely builds more than DC__NUM_DPP__MAX (8) voltage states (up to DC__VOLTAGE_STATES=20), so mode validation reliably indexes past the undersized LinkCapacitySupport array with no race or attacker-uncontrollable condition.\nPR:L - Triggering requires DRM master for atomic modeset, which an unprivileged local user with seat/video access can obtain (first opener of the primary node becomes master without CAP_SYS_ADMIN; compositors also run as the logged-in user), matching other amd/display OOB scores.\nUI:N - The attacker initiates the modeset/ioctl themselves; no separate victim action is required.\nS:U - Impact is confined to kernel memory within the same host security authority (standard local kernel memory corruption / privilege-escalation scope), with no VM escape or IOMMU boundary crossing.\nC:H - Out-of-bounds indexing of LinkCapacitySupport both writes past the array into adjacent vba_vars_st fields and reads those adjacent bytes as mode-support flags; kernel memory corruption of this class is treated as enabling high confidentiality impact.\nI:H - The bug is an out-of-bounds write of bool values into neighboring DML state (VREADY_AT_OR_AFTER_VSYNC, MIN_DST_Y_NEXT_START, and beyond), which is kernel memory corruption usable for integrity impact and control-flow/state corruption.\nA:H - Corrupting adjacent mode-programming state can cause kernel oops/panic or otherwise fatal misbehavior during display bandwidth validation and subsequent programming."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "74458c081fcfb0423877e630de2746daefdb16e4", "lessThan": "3d8a298b2e83b98042e6ec726e934f535b23e6aa", "versionType": "git"}, {"status": "affected", "version": "74458c081fcfb0423877e630de2746daefdb16e4", "lessThan": "aeffc8fb2174f017a10df114bc312f899904dc68", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"status": "unaffected", "version": "0", "lessThan": "5.14", "versionType": "semver"}, {"status": "unaffected", "version": "6.0.13", "versionType": "semver", "lessThanOrEqual": "6.0.*"}, {"status": "unaffected", "version": "6.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3d8a298b2e83b98042e6ec726e934f535b23e6aa"}, {"url": "https://git.kernel.org/stable/c/aeffc8fb2174f017a10df114bc312f899904dc68"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix array index out of bound error in DCN32 DML\n\n[Why&How]\nLinkCapacitySupport array is indexed with the number of voltage states and\nnot the number of max DPPs. Fix the error by changing the array\ndeclaration to use the correct (larger) array size of total number of\nvoltage states."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.0.13", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1", "versionStartIncluding": "5.14"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-12T23:57:22.747Z"}}}, "cveMetadata": {"cveId": "CVE-2022-48979", "state": "PUBLISHED", "dateUpdated": "2026-08-12T23:57:22.747Z", "dateReserved": "2024-08-22T01:27:53.632Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-10-21T20:05:57.707Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3d8a298b2e83b98042e6ec726e934f535b23e6aa", "status": "affected", "version": "74458c081fcfb0423877e630de2746daefdb16e4", "versionType": "git"}, {"lessThan": "aeffc8fb2174f017a10df114bc312f899904dc68", "status": "affected", "version": "74458c081fcfb0423877e630de2746daefdb16e4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.0.*", "status": "unaffected", "version": "6.0.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "307077FA-2651-41AE-A0DB-B92E0E7F5AE0", "versionEndExcluding": "6.0.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "E7E331DA-1FB0-4DEC-91AC-7DA69D461C11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "17F0B248-42CF-4AE6-A469-BB1BAE7F4705", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "E2422816-0C14-4B5E-A1E6-A9D776E5C49B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "1C6E00FE-5FB9-4D20-A1A1-5A32128F9B76", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "35B26BE4-43A6-4A36-A7F6-5B3F572D9186", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*", "matchCriteriaId": "3FFFB0B3-930D-408A-91E2-BAE0C2715D80", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*", "matchCriteriaId": "8535320E-A0DB-4277-800E-D0CE5BBA59E8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*", "matchCriteriaId": "21718AA4-4056-40F2-968E-BDAA465A7872", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix array index out of bound error in DCN32 DML\n\n[Why&How]\nLinkCapacitySupport array is indexed with the number of voltage states and\nnot the number of max DPPs. Fix the error by changing the array\ndeclaration to use the correct (larger) array size of total number of\nvoltage states."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/display: se corrige el error de \u00edndice de matriz fuera de l\u00edmite en DCN32 DML [Por qu\u00e9 y c\u00f3mo] La matriz LinkCapacitySupport est\u00e1 indexada con la cantidad de estados de voltaje y no con la cantidad m\u00e1xima de DPP. Corrija el error modificando la declaraci\u00f3n de la matriz para utilizar el tama\u00f1o de matriz correcto (m\u00e1s grande) de la cantidad total de estados de voltaje."}], "id": "CVE-2022-48979", "lastModified": "2026-08-13T00:17:26.603", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-48979", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-22T13:18:06.288121Z", "version": "2.0.3"}}]}, "published": "2024-10-21T20:15:09.947", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3d8a298b2e83b98042e6ec726e934f535b23e6aa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aeffc8fb2174f017a10df114bc312f899904dc68"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-129"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/amd/display: fix array index out of bound error in DCN32 DML", "id": "2320739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2320739"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-129", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amd/display: fix array index out of bound error in DCN32 DML\n[Why&How]\nLinkCapacitySupport array is indexed with the number of voltage states and\nnot the number of max DPPs. Fix the error by changing the array\ndeclaration to use the correct (larger) array size of total number of\nvoltage states."], "name": "CVE-2022-48979", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-10-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-48979\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-48979\nhttps://lore.kernel.org/linux-cve-announce/2024102146-CVE-2022-48979-d40f@gregkh/T"], "threat_severity": "Low"}

{}