{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2022-48979",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2024-08-22T01:27:53.632Z",
        "datePublished": "2024-10-21T20:05:57.707Z",
        "dateUpdated": "2026-08-12T23:57:22.747Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-12T23:57:22.747Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: fix array index out of bound error in DCN32 DML\n\n[Why&How]\nLinkCapacitySupport array is indexed with the number of voltage states and\nnot the number of max DPPs. Fix the error by changing the array\ndeclaration to use the correct (larger) array size of total number of\nvoltage states."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The bug is reached via DRM atomic modesetting (DRM_IOCTL_MODE_ATOMIC) into amdgpu_dm validation and DCN32 DML (dml32_ModeSupportAndSystemConfigurationFull); exploitation requires local access to the DRM device, not network or adjacent-network reachability.\nAC:L - On affected DCN32 hardware, synthetic/legacy SOC state construction routinely builds more than DC__NUM_DPP__MAX (8) voltage states (up to DC__VOLTAGE_STATES=20), so mode validation reliably indexes past the undersized LinkCapacitySupport array with no race or attacker-uncontrollable condition.\nPR:L - Triggering requires DRM master for atomic modeset, which an unprivileged local user with seat/video access can obtain (first opener of the primary node becomes master without CAP_SYS_ADMIN; compositors also run as the logged-in user), matching other amd/display OOB scores.\nUI:N - The attacker initiates the modeset/ioctl themselves; no separate victim action is required.\nS:U - Impact is confined to kernel memory within the same host security authority (standard local kernel memory corruption / privilege-escalation scope), with no VM escape or IOMMU boundary crossing.\nC:H - Out-of-bounds indexing of LinkCapacitySupport both writes past the array into adjacent vba_vars_st fields and reads those adjacent bytes as mode-support flags; kernel memory corruption of this class is treated as enabling high confidentiality impact.\nI:H - The bug is an out-of-bounds write of bool values into neighboring DML state (VREADY_AT_OR_AFTER_VSYNC, MIN_DST_Y_NEXT_START, and beyond), which is kernel memory corruption usable for integrity impact and control-flow/state corruption.\nA:H - Corrupting adjacent mode-programming state can cause kernel oops/panic or otherwise fatal misbehavior during display bandwidth validation and subsequent programming."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h"
                    ],
                    "versions": [
                        {
                            "version": "74458c081fcfb0423877e630de2746daefdb16e4",
                            "lessThan": "3d8a298b2e83b98042e6ec726e934f535b23e6aa",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "74458c081fcfb0423877e630de2746daefdb16e4",
                            "lessThan": "aeffc8fb2174f017a10df114bc312f899904dc68",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h"
                    ],
                    "versions": [
                        {
                            "version": "5.14",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "5.14",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.0.13",
                            "lessThanOrEqual": "6.0.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.1",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.14",
                                    "versionEndExcluding": "6.0.13"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.14",
                                    "versionEndExcluding": "6.1"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/3d8a298b2e83b98042e6ec726e934f535b23e6aa"
                },
                {
                    "url": "https://git.kernel.org/stable/c/aeffc8fb2174f017a10df114bc312f899904dc68"
                }
            ],
            "title": "drm/amd/display: fix array index out of bound error in DCN32 DML",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "id": "CVE-2022-48979",
                                "role": "CISA Coordinator",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "version": "2.0.3",
                                "timestamp": "2024-10-22T13:18:06.288121Z"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2024-10-22T13:18:44.044Z"
                }
            }
        ]
    }
}