In the Linux kernel, the following vulnerability has been resolved:
drm/radeon: fix potential buffer overflow in nisetmcspecialregisters()
The last case label can write two buffers 'mcregaddress[j]' and 'mcdata[j]' with 'j' offset equal to SMCNISLANDSMCREGISTERARRAYSIZE since there are no checks for this value in both case labels after the last 'j++'.
Instead of changing '>' to '>=' there, add the bounds check at the start of the second 'case' (the first one already has it).
Also, remove redundant last checks for 'j' index bigger than array size. The expression is always false. Moreover, before or after the patch 'table->last' can be equal to SMCNISLANDSMCREGISTERARRAY_SIZE and it seems it can be a valid value.
Detected using the static analysis tool - Svace.
[
{
"signature_type": "Function",
"digest": {
"function_hash": "66238545409274799906239777234053901944",
"length": 1901.0
},
"deprecated": false,
"id": "CVE-2022-50185-071792cf",
"target": {
"function": "ni_set_mc_special_registers",
"file": "drivers/gpu/drm/radeon/ni_dpm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@136f614931a2bb73616b292cf542da3a18daefd5",
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "66238545409274799906239777234053901944",
"length": 1901.0
},
"deprecated": false,
"id": "CVE-2022-50185-206f23c6",
"target": {
"function": "ni_set_mc_special_registers",
"file": "drivers/gpu/drm/radeon/ni_dpm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea73869df6ef386fc0feeb28ff66742ca835b18f",
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "66238545409274799906239777234053901944",
"length": 1901.0
},
"deprecated": false,
"id": "CVE-2022-50185-21847715",
"target": {
"function": "ni_set_mc_special_registers",
"file": "drivers/gpu/drm/radeon/ni_dpm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8508d6d23a247c29792ce2fc0df3f3404d6a6a80",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"179906010133371204719422754175919078949",
"185827945097628373643549916960506981718",
"287650935020419504469132093039741027334",
"66377107982675635764010239120873108681",
"300661751926379969989809310539741603310",
"43083780382714021565656444243838418634",
"277910132774634996203518146591287113385",
"8312669963620348977337902688745572482",
"155394453726763340172436993789957277792",
"287650935020419504469132093039741027334",
"49675074538034267293377711904275132362",
"57376250003325944623726328645704631138"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-50185-32754d3e",
"target": {
"file": "drivers/gpu/drm/radeon/ni_dpm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8508d6d23a247c29792ce2fc0df3f3404d6a6a80",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"179906010133371204719422754175919078949",
"185827945097628373643549916960506981718",
"287650935020419504469132093039741027334",
"66377107982675635764010239120873108681",
"300661751926379969989809310539741603310",
"43083780382714021565656444243838418634",
"277910132774634996203518146591287113385",
"8312669963620348977337902688745572482",
"155394453726763340172436993789957277792",
"287650935020419504469132093039741027334",
"49675074538034267293377711904275132362",
"57376250003325944623726328645704631138"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-50185-3a074568",
"target": {
"file": "drivers/gpu/drm/radeon/ni_dpm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea73869df6ef386fc0feeb28ff66742ca835b18f",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"179906010133371204719422754175919078949",
"185827945097628373643549916960506981718",
"287650935020419504469132093039741027334",
"66377107982675635764010239120873108681",
"300661751926379969989809310539741603310",
"43083780382714021565656444243838418634",
"277910132774634996203518146591287113385",
"8312669963620348977337902688745572482",
"155394453726763340172436993789957277792",
"287650935020419504469132093039741027334",
"49675074538034267293377711904275132362",
"57376250003325944623726328645704631138"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-50185-68c194a8",
"target": {
"file": "drivers/gpu/drm/radeon/ni_dpm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9faff03617afeced1c4e5daa89e79b3906374342",
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "66238545409274799906239777234053901944",
"length": 1901.0
},
"deprecated": false,
"id": "CVE-2022-50185-7a2350ce",
"target": {
"function": "ni_set_mc_special_registers",
"file": "drivers/gpu/drm/radeon/ni_dpm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@deb603c5928e546609c0d5798e231d0205748943",
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "66238545409274799906239777234053901944",
"length": 1901.0
},
"deprecated": false,
"id": "CVE-2022-50185-8081c086",
"target": {
"function": "ni_set_mc_special_registers",
"file": "drivers/gpu/drm/radeon/ni_dpm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@782e413e38dffd37cc85b08b1ccb982adb4a93ce",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"179906010133371204719422754175919078949",
"185827945097628373643549916960506981718",
"287650935020419504469132093039741027334",
"66377107982675635764010239120873108681",
"300661751926379969989809310539741603310",
"43083780382714021565656444243838418634",
"277910132774634996203518146591287113385",
"8312669963620348977337902688745572482",
"155394453726763340172436993789957277792",
"287650935020419504469132093039741027334",
"49675074538034267293377711904275132362",
"57376250003325944623726328645704631138"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-50185-8cedfd14",
"target": {
"file": "drivers/gpu/drm/radeon/ni_dpm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f341053852be76f82610ce47a505d930512f05c",
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "66238545409274799906239777234053901944",
"length": 1901.0
},
"deprecated": false,
"id": "CVE-2022-50185-951f3b50",
"target": {
"function": "ni_set_mc_special_registers",
"file": "drivers/gpu/drm/radeon/ni_dpm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9faff03617afeced1c4e5daa89e79b3906374342",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"179906010133371204719422754175919078949",
"185827945097628373643549916960506981718",
"287650935020419504469132093039741027334",
"66377107982675635764010239120873108681",
"300661751926379969989809310539741603310",
"43083780382714021565656444243838418634",
"277910132774634996203518146591287113385",
"8312669963620348977337902688745572482",
"155394453726763340172436993789957277792",
"287650935020419504469132093039741027334",
"49675074538034267293377711904275132362",
"57376250003325944623726328645704631138"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-50185-b6516dc0",
"target": {
"file": "drivers/gpu/drm/radeon/ni_dpm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@deb603c5928e546609c0d5798e231d0205748943",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"179906010133371204719422754175919078949",
"185827945097628373643549916960506981718",
"287650935020419504469132093039741027334",
"66377107982675635764010239120873108681",
"300661751926379969989809310539741603310",
"43083780382714021565656444243838418634",
"277910132774634996203518146591287113385",
"8312669963620348977337902688745572482",
"155394453726763340172436993789957277792",
"287650935020419504469132093039741027334",
"49675074538034267293377711904275132362",
"57376250003325944623726328645704631138"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-50185-c06306fd",
"target": {
"file": "drivers/gpu/drm/radeon/ni_dpm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@782e413e38dffd37cc85b08b1ccb982adb4a93ce",
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "66238545409274799906239777234053901944",
"length": 1901.0
},
"deprecated": false,
"id": "CVE-2022-50185-c37b94cc",
"target": {
"function": "ni_set_mc_special_registers",
"file": "drivers/gpu/drm/radeon/ni_dpm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db1a9add3f90ff1c641974d5bb910c16b87af4ef",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"179906010133371204719422754175919078949",
"185827945097628373643549916960506981718",
"287650935020419504469132093039741027334",
"66377107982675635764010239120873108681",
"300661751926379969989809310539741603310",
"43083780382714021565656444243838418634",
"277910132774634996203518146591287113385",
"8312669963620348977337902688745572482",
"155394453726763340172436993789957277792",
"287650935020419504469132093039741027334",
"49675074538034267293377711904275132362",
"57376250003325944623726328645704631138"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-50185-d3883e30",
"target": {
"file": "drivers/gpu/drm/radeon/ni_dpm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@136f614931a2bb73616b292cf542da3a18daefd5",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"179906010133371204719422754175919078949",
"185827945097628373643549916960506981718",
"287650935020419504469132093039741027334",
"66377107982675635764010239120873108681",
"300661751926379969989809310539741603310",
"43083780382714021565656444243838418634",
"277910132774634996203518146591287113385",
"8312669963620348977337902688745572482",
"155394453726763340172436993789957277792",
"287650935020419504469132093039741027334",
"49675074538034267293377711904275132362",
"57376250003325944623726328645704631138"
],
"threshold": 0.9
},
"deprecated": false,
"id": "CVE-2022-50185-f35aa387",
"target": {
"file": "drivers/gpu/drm/radeon/ni_dpm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db1a9add3f90ff1c641974d5bb910c16b87af4ef",
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "66238545409274799906239777234053901944",
"length": 1901.0
},
"deprecated": false,
"id": "CVE-2022-50185-f734deeb",
"target": {
"function": "ni_set_mc_special_registers",
"file": "drivers/gpu/drm/radeon/ni_dpm.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f341053852be76f82610ce47a505d930512f05c",
"signature_version": "v1"
}
]