In the Linux kernel, the following vulnerability has been resolved:
drm: nv04: Fix out of bounds access
When Output Resource (dcb->or) value is assigned in fabricatedcboutput(), there may be out of bounds access to dacusers array in case dcb->or is zero because ffs(dcb->or) is used as index there. The 'or' argument of fabricatedcb_output() must be interpreted as a number of bit to set, not value.
Utilize macros from 'enum nouveau_or' in calls instead of hardcoding.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
[
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "apply_dcb_encoder_quirks",
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26212da39ee14a52c76a202c6ae5153a84f579a5",
"digest": {
"function_hash": "275086234099987066219298980795653469172",
"length": 1543.0
},
"signature_type": "Function",
"id": "CVE-2024-27008-0b8bdd08"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "fabricate_dcb_encoder_table",
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26212da39ee14a52c76a202c6ae5153a84f579a5",
"digest": {
"function_hash": "38557189588848920623911916015633736882",
"length": 721.0
},
"signature_type": "Function",
"id": "CVE-2024-27008-0e09d5af"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "apply_dcb_encoder_quirks",
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf92bb778eda7830e79452c6917efa8474a30c1e",
"digest": {
"function_hash": "275086234099987066219298980795653469172",
"length": 1543.0
},
"signature_type": "Function",
"id": "CVE-2024-27008-33900003"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "fabricate_dcb_encoder_table",
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf92bb778eda7830e79452c6917efa8474a30c1e",
"digest": {
"function_hash": "38557189588848920623911916015633736882",
"length": 721.0
},
"signature_type": "Function",
"id": "CVE-2024-27008-39b5bf98"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@097c7918fcfa1dee233acfd1f3029f00c3bc8062",
"digest": {
"line_hashes": [
"108444459028687942013067116120595142312",
"25040828889341400031092949320313285797",
"276632980141803715972041900197519763319",
"213607137548302945729217081793908810691",
"336667938544391973500487151172331845860",
"147109823467332341224676312000554490348",
"310875347102008613258490770369014323031",
"250582265659842741028696823459882481402",
"117460958214292702277515659493151772291",
"280294240806606273131581855877703408088",
"37040695701320931504028091871231175637",
"286140315329962201199040079526079928257",
"21131766329304880448989655211487785203",
"40882120042664773812059795840009723152",
"99141051263317000852158991340610617259",
"196163500654332958496671494240009588222",
"143168247055156735025608907147385094024",
"89208749511104136417801325100653748292",
"273905648274872254367412336341591418014",
"139461552825277001413706540902344306725",
"259260328124594030765359374834396345343",
"327211585119169483207180276722391426721",
"9658503305507844576237445555609916928",
"27386006554423112525212433566304405742"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2024-27008-4226feab"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "apply_dcb_encoder_quirks",
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5fd4b090304e450aa0e7cc9cc2b4873285c6face",
"digest": {
"function_hash": "275086234099987066219298980795653469172",
"length": 1543.0
},
"signature_type": "Function",
"id": "CVE-2024-27008-44fb33cb"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6690cc2732e2a8d0eaca44dcbac032a4b0148042",
"digest": {
"line_hashes": [
"108444459028687942013067116120595142312",
"25040828889341400031092949320313285797",
"276632980141803715972041900197519763319",
"213607137548302945729217081793908810691",
"336667938544391973500487151172331845860",
"147109823467332341224676312000554490348",
"310875347102008613258490770369014323031",
"250582265659842741028696823459882481402",
"117460958214292702277515659493151772291",
"280294240806606273131581855877703408088",
"37040695701320931504028091871231175637",
"286140315329962201199040079526079928257",
"21131766329304880448989655211487785203",
"40882120042664773812059795840009723152",
"99141051263317000852158991340610617259",
"196163500654332958496671494240009588222",
"143168247055156735025608907147385094024",
"89208749511104136417801325100653748292",
"273905648274872254367412336341591418014",
"139461552825277001413706540902344306725",
"259260328124594030765359374834396345343",
"327211585119169483207180276722391426721",
"9658503305507844576237445555609916928",
"27386006554423112525212433566304405742"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2024-27008-4d21682b"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "apply_dcb_encoder_quirks",
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5050ae879a828d752b439e3827aac126709da6d1",
"digest": {
"function_hash": "275086234099987066219298980795653469172",
"length": 1543.0
},
"signature_type": "Function",
"id": "CVE-2024-27008-4d231586"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df0991da7db846f7fa4ec6740350f743d3b69b04",
"digest": {
"line_hashes": [
"108444459028687942013067116120595142312",
"25040828889341400031092949320313285797",
"276632980141803715972041900197519763319",
"213607137548302945729217081793908810691",
"336667938544391973500487151172331845860",
"147109823467332341224676312000554490348",
"310875347102008613258490770369014323031",
"250582265659842741028696823459882481402",
"117460958214292702277515659493151772291",
"280294240806606273131581855877703408088",
"37040695701320931504028091871231175637",
"286140315329962201199040079526079928257",
"21131766329304880448989655211487785203",
"40882120042664773812059795840009723152",
"99141051263317000852158991340610617259",
"196163500654332958496671494240009588222",
"143168247055156735025608907147385094024",
"89208749511104136417801325100653748292",
"273905648274872254367412336341591418014",
"139461552825277001413706540902344306725",
"259260328124594030765359374834396345343",
"327211585119169483207180276722391426721",
"9658503305507844576237445555609916928",
"27386006554423112525212433566304405742"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2024-27008-4e38ae1a"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "apply_dcb_encoder_quirks",
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c2b97f26f081ceec3298151481687071075a25cb",
"digest": {
"function_hash": "275086234099987066219298980795653469172",
"length": 1543.0
},
"signature_type": "Function",
"id": "CVE-2024-27008-52f3e44e"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "fabricate_dcb_encoder_table",
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df0991da7db846f7fa4ec6740350f743d3b69b04",
"digest": {
"function_hash": "38557189588848920623911916015633736882",
"length": 721.0
},
"signature_type": "Function",
"id": "CVE-2024-27008-5f84c59e"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c2b97f26f081ceec3298151481687071075a25cb",
"digest": {
"line_hashes": [
"211792600366749751140732953453639125166",
"108444459028687942013067116120595142312",
"25040828889341400031092949320313285797",
"276632980141803715972041900197519763319",
"213607137548302945729217081793908810691",
"336667938544391973500487151172331845860",
"147109823467332341224676312000554490348",
"310875347102008613258490770369014323031",
"250582265659842741028696823459882481402",
"117460958214292702277515659493151772291",
"280294240806606273131581855877703408088",
"37040695701320931504028091871231175637",
"286140315329962201199040079526079928257",
"21131766329304880448989655211487785203",
"40882120042664773812059795840009723152",
"99141051263317000852158991340610617259",
"196163500654332958496671494240009588222",
"143168247055156735025608907147385094024",
"89208749511104136417801325100653748292",
"273905648274872254367412336341591418014",
"139461552825277001413706540902344306725",
"259260328124594030765359374834396345343",
"327211585119169483207180276722391426721",
"9658503305507844576237445555609916928",
"27386006554423112525212433566304405742"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2024-27008-6942c227"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5050ae879a828d752b439e3827aac126709da6d1",
"digest": {
"line_hashes": [
"108444459028687942013067116120595142312",
"25040828889341400031092949320313285797",
"276632980141803715972041900197519763319",
"213607137548302945729217081793908810691",
"336667938544391973500487151172331845860",
"147109823467332341224676312000554490348",
"310875347102008613258490770369014323031",
"250582265659842741028696823459882481402",
"117460958214292702277515659493151772291",
"280294240806606273131581855877703408088",
"37040695701320931504028091871231175637",
"286140315329962201199040079526079928257",
"21131766329304880448989655211487785203",
"40882120042664773812059795840009723152",
"99141051263317000852158991340610617259",
"196163500654332958496671494240009588222",
"143168247055156735025608907147385094024",
"89208749511104136417801325100653748292",
"273905648274872254367412336341591418014",
"139461552825277001413706540902344306725",
"259260328124594030765359374834396345343",
"327211585119169483207180276722391426721",
"9658503305507844576237445555609916928",
"27386006554423112525212433566304405742"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2024-27008-786cfbba"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "fabricate_dcb_encoder_table",
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5fd4b090304e450aa0e7cc9cc2b4873285c6face",
"digest": {
"function_hash": "38557189588848920623911916015633736882",
"length": 721.0
},
"signature_type": "Function",
"id": "CVE-2024-27008-8041de7f"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "apply_dcb_encoder_quirks",
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df0991da7db846f7fa4ec6740350f743d3b69b04",
"digest": {
"function_hash": "275086234099987066219298980795653469172",
"length": 1543.0
},
"signature_type": "Function",
"id": "CVE-2024-27008-980d944e"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "fabricate_dcb_encoder_table",
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c2b97f26f081ceec3298151481687071075a25cb",
"digest": {
"function_hash": "38557189588848920623911916015633736882",
"length": 721.0
},
"signature_type": "Function",
"id": "CVE-2024-27008-a9e4bc4d"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "apply_dcb_encoder_quirks",
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6690cc2732e2a8d0eaca44dcbac032a4b0148042",
"digest": {
"function_hash": "275086234099987066219298980795653469172",
"length": 1543.0
},
"signature_type": "Function",
"id": "CVE-2024-27008-aafc3053"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "fabricate_dcb_encoder_table",
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6690cc2732e2a8d0eaca44dcbac032a4b0148042",
"digest": {
"function_hash": "38557189588848920623911916015633736882",
"length": 721.0
},
"signature_type": "Function",
"id": "CVE-2024-27008-b3aa6aa2"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "fabricate_dcb_encoder_table",
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5050ae879a828d752b439e3827aac126709da6d1",
"digest": {
"function_hash": "38557189588848920623911916015633736882",
"length": 721.0
},
"signature_type": "Function",
"id": "CVE-2024-27008-ba7a0461"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26212da39ee14a52c76a202c6ae5153a84f579a5",
"digest": {
"line_hashes": [
"108444459028687942013067116120595142312",
"25040828889341400031092949320313285797",
"276632980141803715972041900197519763319",
"213607137548302945729217081793908810691",
"336667938544391973500487151172331845860",
"147109823467332341224676312000554490348",
"310875347102008613258490770369014323031",
"250582265659842741028696823459882481402",
"117460958214292702277515659493151772291",
"280294240806606273131581855877703408088",
"37040695701320931504028091871231175637",
"286140315329962201199040079526079928257",
"21131766329304880448989655211487785203",
"40882120042664773812059795840009723152",
"99141051263317000852158991340610617259",
"196163500654332958496671494240009588222",
"143168247055156735025608907147385094024",
"89208749511104136417801325100653748292",
"273905648274872254367412336341591418014",
"139461552825277001413706540902344306725",
"259260328124594030765359374834396345343",
"327211585119169483207180276722391426721",
"9658503305507844576237445555609916928",
"27386006554423112525212433566304405742"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2024-27008-bc81099c"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "fabricate_dcb_encoder_table",
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@097c7918fcfa1dee233acfd1f3029f00c3bc8062",
"digest": {
"function_hash": "38557189588848920623911916015633736882",
"length": 721.0
},
"signature_type": "Function",
"id": "CVE-2024-27008-cc6adb0e"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf92bb778eda7830e79452c6917efa8474a30c1e",
"digest": {
"line_hashes": [
"108444459028687942013067116120595142312",
"25040828889341400031092949320313285797",
"276632980141803715972041900197519763319",
"213607137548302945729217081793908810691",
"336667938544391973500487151172331845860",
"147109823467332341224676312000554490348",
"310875347102008613258490770369014323031",
"250582265659842741028696823459882481402",
"117460958214292702277515659493151772291",
"280294240806606273131581855877703408088",
"37040695701320931504028091871231175637",
"286140315329962201199040079526079928257",
"21131766329304880448989655211487785203",
"40882120042664773812059795840009723152",
"99141051263317000852158991340610617259",
"196163500654332958496671494240009588222",
"143168247055156735025608907147385094024",
"89208749511104136417801325100653748292",
"273905648274872254367412336341591418014",
"139461552825277001413706540902344306725",
"259260328124594030765359374834396345343",
"327211585119169483207180276722391426721",
"9658503305507844576237445555609916928",
"27386006554423112525212433566304405742"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2024-27008-d9d9714d"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5fd4b090304e450aa0e7cc9cc2b4873285c6face",
"digest": {
"line_hashes": [
"108444459028687942013067116120595142312",
"25040828889341400031092949320313285797",
"276632980141803715972041900197519763319",
"213607137548302945729217081793908810691",
"336667938544391973500487151172331845860",
"147109823467332341224676312000554490348",
"310875347102008613258490770369014323031",
"250582265659842741028696823459882481402",
"117460958214292702277515659493151772291",
"280294240806606273131581855877703408088",
"37040695701320931504028091871231175637",
"286140315329962201199040079526079928257",
"21131766329304880448989655211487785203",
"40882120042664773812059795840009723152",
"99141051263317000852158991340610617259",
"196163500654332958496671494240009588222",
"143168247055156735025608907147385094024",
"89208749511104136417801325100653748292",
"273905648274872254367412336341591418014",
"139461552825277001413706540902344306725",
"259260328124594030765359374834396345343",
"327211585119169483207180276722391426721",
"9658503305507844576237445555609916928",
"27386006554423112525212433566304405742"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2024-27008-f4c475d2"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "apply_dcb_encoder_quirks",
"file": "drivers/gpu/drm/nouveau/nouveau_bios.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@097c7918fcfa1dee233acfd1f3029f00c3bc8062",
"digest": {
"function_hash": "275086234099987066219298980795653469172",
"length": 1543.0
},
"signature_type": "Function",
"id": "CVE-2024-27008-f7f65ac4"
}
]