CVE-2024-38552drm/amd/display: Fix potential index out of bounds in color transformation function
- 7.3HighCVSS base score
- 0.30%Exploitation in 30 daysEPSS · top 77% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential index out of bounds in color transformation function Fixes index out of bounds issue in the color transformation function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS). The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds, an error message is logged and the function returns false to indicate an error. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max
Timeline
ID reserved
By Linux
- 1 day later
· 1 day later
Published
- 2 years later
· 2 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H |
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.30% · top 77% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.3.
Affected products
- affected b629596072e5fa901c84f9e88d845a696ee32942 – < 604c506ca43fce52bb882cff9c1fdf2ec3b4029c
- affected b629596072e5fa901c84f9e88d845a696ee32942 – < e280ab978c81443103d7c61bdd1d8d708cf6ed6d
- affected b629596072e5fa901c84f9e88d845a696ee32942 – < 04bc4d1090c343025d69149ca669a27c5b9c34a7
- affected b629596072e5fa901c84f9e88d845a696ee32942 – < ced9c4e2289a786b8fa684d8893b7045ea53ef7e
- affected b629596072e5fa901c84f9e88d845a696ee32942 – < 98b8a6bfd30d07a19cfacdf82b50f84bf3360869
- affected b629596072e5fa901c84f9e88d845a696ee32942 – < 4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86
- affected b629596072e5fa901c84f9e88d845a696ee32942 – < 123edbae64f4d21984359b99c6e79fcde31c6123
- affected b629596072e5fa901c84f9e88d845a696ee32942 – < 7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29
- affected b629596072e5fa901c84f9e88d845a696ee32942 – < 63ae548f1054a0b71678d0349c7dc9628ddd42ca
- affected 4.16
- unaffected < 4.16
- unaffected 4.19.316 – ≤ 4.19.*
- unaffected 5.4.278 – ≤ 5.4.*
- unaffected 5.10.219 – ≤ 5.10.*
- unaffected 5.15.161 – ≤ 5.15.*
- unaffected 6.1.93 – ≤ 6.1.*
- unaffected 6.6.33 – ≤ 6.6.*
- unaffected 6.8.12 – ≤ 6.8.*
- unaffected 6.9.3 – ≤ 6.9.*
- unaffected 6.10 – ≤ *
References
References11
- https://git.kernel.org/stable/c/604c506ca43fce52bb882cff9c1fdf2ec3b4029c (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/e280ab978c81443103d7c61bdd1d8d708cf6ed6d (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/04bc4d1090c343025d69149ca669a27c5b9c34a7 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/ced9c4e2289a786b8fa684d8893b7045ea53ef7e (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/98b8a6bfd30d07a19cfacdf82b50f84bf3360869 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/63ae548f1054a0b71678d0349c7dc9628ddd42ca (opens in a new tab)x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-37415 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-38552)Record last updated .