CVE-2024-40987 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix UBSAN warning in kv_dpm.c Adds bounds check for sumo_vid_mapping_entry.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/1c44f7759a5650acf8f13d3e0a184d09e03be9e4
https://git.kernel.org/stable/c/4ad7d49059358ceadd352b4e2511425bdb68f400
https://git.kernel.org/stable/c/4d020c1dbd2b2304f44d003e6de956ae570049dc
https://git.kernel.org/stable/c/b065d79ed06a0bb4377bc6dcc2ff0cb1f55a798f
https://git.kernel.org/stable/c/b0d612619ed70cab476c77b19e00d13aa414e14f
https://git.kernel.org/stable/c/d8a04a6bfa75251ba7bcc3651ed211e82f13f388
https://git.kernel.org/stable/c/f0d576f840153392d04b2d52cf3adab8f62e8cb6
https://git.kernel.org/stable/c/fc5cb952e6723c5c55e47b8cf94a891bd4af1a86
https://lore.kernel.org/linux-cve-announce/2024071248-CVE-2024-40987-a755@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-40987
https://www.cve.org/CVERecord?id=CVE-2024-40987

History

Wed, 11 Sep 2024 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-07-12T12:37:32.490Z

Updated: 2024-11-05T09:34:33.406Z

Reserved: 2024-07-12T12:17:45.605Z

Link: CVE-2024-40987

Vulnrichment

Updated: 2024-09-11T12:42:22.112Z

NVD

Status : Awaiting Analysis

Published: 2024-07-12T13:15:20.180

Modified: 2024-07-12T16:34:58.687

Link: CVE-2024-40987

Redhat

Severity : Moderate

Publid Date: 2024-07-12T00:00:00Z

Links: CVE-2024-40987 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-40987", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.605Z", "datePublished": "2024-07-12T12:37:32.490Z", "dateUpdated": "2024-11-05T09:34:33.406Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-05T09:34:33.406Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix UBSAN warning in kv_dpm.c\n\nAdds bounds check for sumo_vid_mapping_entry."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c"], "versions": [{"version": "1da177e4c3f4", "lessThan": "4ad7d4905935", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "1c44f7759a56", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "d8a04a6bfa75", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "4d020c1dbd2b", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "fc5cb952e672", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "b065d79ed06a", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "b0d612619ed7", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "f0d576f84015", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c"], "versions": [{"version": "4.19.317", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.279", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.221", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.162", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.96", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.36", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.7", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/4ad7d49059358ceadd352b4e2511425bdb68f400"}, {"url": "https://git.kernel.org/stable/c/1c44f7759a5650acf8f13d3e0a184d09e03be9e4"}, {"url": "https://git.kernel.org/stable/c/d8a04a6bfa75251ba7bcc3651ed211e82f13f388"}, {"url": "https://git.kernel.org/stable/c/4d020c1dbd2b2304f44d003e6de956ae570049dc"}, {"url": "https://git.kernel.org/stable/c/fc5cb952e6723c5c55e47b8cf94a891bd4af1a86"}, {"url": "https://git.kernel.org/stable/c/b065d79ed06a0bb4377bc6dcc2ff0cb1f55a798f"}, {"url": "https://git.kernel.org/stable/c/b0d612619ed70cab476c77b19e00d13aa414e14f"}, {"url": "https://git.kernel.org/stable/c/f0d576f840153392d04b2d52cf3adab8f62e8cb6"}], "title": "drm/amdgpu: fix UBSAN warning in kv_dpm.c", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:55.996Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/4ad7d49059358ceadd352b4e2511425bdb68f400", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1c44f7759a5650acf8f13d3e0a184d09e03be9e4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d8a04a6bfa75251ba7bcc3651ed211e82f13f388", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/4d020c1dbd2b2304f44d003e6de956ae570049dc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/fc5cb952e6723c5c55e47b8cf94a891bd4af1a86", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b065d79ed06a0bb4377bc6dcc2ff0cb1f55a798f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b0d612619ed70cab476c77b19e00d13aa414e14f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/f0d576f840153392d04b2d52cf3adab8f62e8cb6", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40987", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:02:00.830583Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:20.703Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-40987", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.605Z", "datePublished": "2024-07-12T12:37:32.490Z", "dateUpdated": "2024-08-02T04:39:55.996Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-07-15T06:52:51.252Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix UBSAN warning in kv_dpm.c\n\nAdds bounds check for sumo_vid_mapping_entry."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c"], "versions": [{"version": "1da177e4c3f4", "lessThan": "4ad7d4905935", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "1c44f7759a56", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "d8a04a6bfa75", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "4d020c1dbd2b", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "fc5cb952e672", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "b065d79ed06a", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "b0d612619ed7", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "f0d576f84015", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c"], "versions": [{"version": "4.19.317", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "custom"}, {"version": "5.4.279", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "custom"}, {"version": "5.10.221", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "custom"}, {"version": "5.15.162", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.1.96", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.6.36", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.9.7", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/4ad7d49059358ceadd352b4e2511425bdb68f400"}, {"url": "https://git.kernel.org/stable/c/1c44f7759a5650acf8f13d3e0a184d09e03be9e4"}, {"url": "https://git.kernel.org/stable/c/d8a04a6bfa75251ba7bcc3651ed211e82f13f388"}, {"url": "https://git.kernel.org/stable/c/4d020c1dbd2b2304f44d003e6de956ae570049dc"}, {"url": "https://git.kernel.org/stable/c/fc5cb952e6723c5c55e47b8cf94a891bd4af1a86"}, {"url": "https://git.kernel.org/stable/c/b065d79ed06a0bb4377bc6dcc2ff0cb1f55a798f"}, {"url": "https://git.kernel.org/stable/c/b0d612619ed70cab476c77b19e00d13aa414e14f"}, {"url": "https://git.kernel.org/stable/c/f0d576f840153392d04b2d52cf3adab8f62e8cb6"}], "title": "drm/amdgpu: fix UBSAN warning in kv_dpm.c", "x_generator": {"engine": "bippy-c9c4e1df01b2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40987", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:02:00.830583Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2024-09-11T12:42:22.112Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"bugzilla": {"description": "kernel: drm/amdgpu: fix UBSAN warning in kv_dpm.c", "id": "2297571", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2297571"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdgpu: fix UBSAN warning in kv_dpm.c\nAdds bounds check for sumo_vid_mapping_entry."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-40987", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-40987\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-40987\nhttps://lore.kernel.org/linux-cve-announce/2024071248-CVE-2024-40987-a755@gregkh/T"], "statement": "Red Hat Enterprise Linux is not impacted by this CVE, as the vulnerability in question does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue, and no further action or mitigation is necessary for systems running this operating system.", "threat_severity": "Moderate", "upstream_fix": "kernel 4.19.317, kernel 5.4.279, kernel 5.10.221, kernel 5.15.162, kernel 6.1.96, kernel 6.6.36, kernel 6.9.7, kernel 6.10-rc5"}