{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2022-50079",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-06-18T10:57:27.409Z",
        "datePublished": "2025-06-18T11:02:22.235Z",
        "dateUpdated": "2026-08-05T08:57:20.643Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T08:57:20.643Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check correct bounds for stream encoder instances for DCN303\n\n[Why & How]\neng_id for DCN303 cannot be more than 1, since we have only two\ninstances of stream encoders.\n\nCheck the correct boundary condition for engine ID for DCN303 prevent\nthe potential out of bounds access."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The bug is in amdgpu display-core resource construction (`amdgpu_dm_init` → `dc_create` → `dcn303_resource_construct` → `resource_construct` → `dcn303_stream_encoder_create`), reachable only during local GPU probe/module load with no network or physical-bus path.\nAC:H - Reaching an out-of-bounds `eng_id` requires a value ≥ 2, but the sole caller loops `i < res_cap_dcn303.num_stream_encoder` where that count is a compile-time constant of 2 that no code path modifies — the required condition is entirely outside any attacker's influence.\nPR:L - The code runs during driver probe at boot or module load rather than via an unprivileged ioctl; scoring the more severe arguable option (probe/autoload reachable to a low-privileged local user on a Beige Goby system) rather than requiring full root.\nUI:N - Resource-pool construction happens automatically during amdgpu initialization with no victim action such as mounting a filesystem or opening a file.\nS:U - Any resulting corruption stays within the kernel's own security authority on the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - An out-of-bounds read past `stream_enc_regs[]` yields values stored as MMIO register offsets, so encoder helpers would read arbitrary GPU registers outside the intended DIO block, exposing device and potentially framebuffer/engine state.\nI:H - The same bogus offsets are used for `REG_UPDATE`/`REG_SET` writes, enabling writes to unintended GPU registers in the aperture and corrupting display-engine state on a DMA-capable device that on APUs shares system memory.\nA:H - Programming a stream encoder through a garbage register-offset table would misprogram or hang the GPU display pipeline and can oops the driver, causing full availability loss for graphics and potentially the machine."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/gpu/drm/amd/display/dc/dcn303/dcn303_resource.c"
                    ],
                    "versions": [
                        {
                            "version": "cd6d421e3d1ad5926b74091254e345db730e7706",
                            "lessThan": "82a27c1855445d48aacc67b0c0640f3dadebe52f",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "cd6d421e3d1ad5926b74091254e345db730e7706",
                            "lessThan": "4c31dca1799612eb3b6413e3e574f90c3fb8f865",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "cd6d421e3d1ad5926b74091254e345db730e7706",
                            "lessThan": "89b008222c2bf21e50219725caed31590edfd9d1",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/gpu/drm/amd/display/dc/dcn303/dcn303_resource.c"
                    ],
                    "versions": [
                        {
                            "version": "5.14",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "5.14",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.15.63",
                            "lessThanOrEqual": "5.15.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.19.4",
                            "lessThanOrEqual": "5.19.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.0",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.14",
                                    "versionEndExcluding": "5.15.63"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.14",
                                    "versionEndExcluding": "5.19.4"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.14",
                                    "versionEndExcluding": "6.0"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/82a27c1855445d48aacc67b0c0640f3dadebe52f"
                },
                {
                    "url": "https://git.kernel.org/stable/c/4c31dca1799612eb3b6413e3e574f90c3fb8f865"
                },
                {
                    "url": "https://git.kernel.org/stable/c/89b008222c2bf21e50219725caed31590edfd9d1"
                }
            ],
            "title": "drm/amd/display: Check correct bounds for stream encoder instances for DCN303",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}