SB20240603105 - Improper locking in Linux kernel display amdgpu_dm driver

Description

This security bulletin contains information about 1 security vulnerability.

1) Improper locking (CVE-ID: CVE-2023-52485)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the dpia_query_hpd_status() function in drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia.c, within the get_usbc_cable_id() function in drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_capability.c, within the dcn32_apply_idle_power_optimizations() function in drivers/gpu/drm/amd/display/dc/hwss/dcn32/dcn32_hwseq.c, within the dcn31_z10_save_init() and dcn31_z10_restore() functions in drivers/gpu/drm/amd/display/dc/hwss/dcn31/dcn31_hwseq.c, within the dcn30_apply_idle_power_optimizations() function in drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c, within the dmub_abm_set_pipe() and dmub_abm_set_backlight() functions in drivers/gpu/drm/amd/display/dc/hwss/dcn21/dcn21_hwseq.c, within the dcn31_query_backlight_info() and dcn31_panel_cntl_hw_init() functions in drivers/gpu/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c, within the query_dp_alt_from_dmub() and link_dpia_control() functions in drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dio_link_encoder.c, within the dmcub_PLAT_54186_wa() function in drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hubp.c, within the dmub_psr_set_version(), dmub_psr_enable(), dmub_psr_set_level(), dmub_psr_set_sink_vtotal_in_psr_active(), dmub_psr_set_power_opt(), dmub_psr_copy_settings() and dmub_psr_force_static() functions in drivers/gpu/drm/amd/display/dc/dce/dmub_psr.c, within the dmub_enable_outbox_notification() function in drivers/gpu/drm/amd/display/dc/dce/dmub_outbox.c, within the dmub_hw_lock_mgr_cmd() function in drivers/gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c, within the dmub_abm_enable_fractional_pwm(), dmub_abm_set_level(), dmub_abm_init_config(), dmub_abm_set_pause(), dmub_abm_save_restore(), dmub_abm_set_pipe() and dmub_abm_set_backlight_level() functions in drivers/gpu/drm/amd/display/dc/dce/dmub_abm_lcd.c, within the submit_dmub_read_modify_write(), submit_dmub_burst_write() and submit_dmub_reg_wait() functions in drivers/gpu/drm/amd/display/dc/dc_helper.c, within the dc_dmub_srv_drr_update_cmd(), dc_dmub_srv_set_drr_manual_trigger_cmd(), dc_dmub_srv_p_state_delegate(), dc_dmub_srv_query_caps_cmd(), dc_dmub_srv_get_visual_confirm_color_cmd(), dc_dmub_setup_subvp_dmub_command(), dc_send_update_cursor_info_to_dmu(), dc_dmub_srv_notify_idle() and dc_dmub_srv_apply_idle_power_optimizations() functions in drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c, within the hwss_send_dmcub_cmd() function in drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c, within the dc_stream_forward_dmub_crc_window(), dc_dmub_update_dirty_rect(), dc_process_dmub_aux_transfer_async(), dc_process_dmub_set_config_async(), dc_process_dmub_set_mst_slots() and dc_process_dmub_dpia_hpd_int_enable() functions in drivers/gpu/drm/amd/display/dc/core/dc.c, within the dcn35_update_clocks() function in drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c, within the dcn316_update_clocks() function in drivers/gpu/drm/amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c, within the dcn315_update_clocks() function in drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c, within the dcn314_update_clocks() function in drivers/gpu/drm/amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c, within the dcn31_update_clocks() function in drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c, within the encoder_control_dmcub(), transmitter_control_dmcub(), transmitter_control_dmcub_v1_7(), set_pixel_clock_dmcub(), enable_disp_power_gating_dmcub() and enable_lvtma_control_dmcub() functions in drivers/gpu/drm/amd/display/dc/bios/command_table2.c, within the dm_edid_parser_send_cea() function in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c. A local user can perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/303197775a97416b62d4da69280d0c120a20e009
• https://git.kernel.org/stable/c/8892780834ae294bc3697c7d0e056d7743900b39
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.3
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8