Vulnerability Description
dp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel through 5.14.14 allows a heap-based buffer overflow by an attacker who can write a string to the AMD GPU display drivers debug filesystem. There are no checks on size within parse_write_buffer_into_params when it uses the size of copy_from_user to copy a userspace buffer into a 40-byte heap buffer.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | <= 5.14.14 |
| Fedoraproject | Fedora | 35 |
| Netapp | H300S Firmware | - |
| Netapp | H300S | - |
| Netapp | H500S Firmware | - |
| Netapp | H500S | - |
| Netapp | H700S Firmware | - |
| Netapp | H700S | - |
| Netapp | H300E Firmware | - |
| Netapp | H300E | - |
| Netapp | H500E Firmware | - |
| Netapp | H500E | - |
| Netapp | H700E Firmware | - |
| Netapp | H700E | - |
| Netapp | H410S Firmware | - |
| Netapp | H410S | - |
| Netapp | H410C Firmware | - |
| Netapp | H410C | - |
Related Weaknesses (CWE)
References
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f2375
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gVendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.netapp.com/advisory/ntap-20211118-0005/Third Party Advisory
- https://www.mail-archive.com/amd-gfx%40lists.freedesktop.org/msg69080.html
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f2375
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gVendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.netapp.com/advisory/ntap-20211118-0005/Third Party Advisory
- https://www.mail-archive.com/amd-gfx%40lists.freedesktop.org/msg69080.html
FAQ
What is CVE-2021-42327?
CVE-2021-42327 is a vulnerability with a CVSS score of 6.7 (MEDIUM). dp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel through 5.14.14 allows a heap-based buffer overflow by an attacker who can write a string to the...
How severe is CVE-2021-42327?
CVE-2021-42327 has been rated MEDIUM with a CVSS base score of 6.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-42327?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Fedoraproject Fedora, Netapp H300S Firmware, Netapp H300S, Netapp H500S Firmware.