CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's AMD GPU driver, specifically in the handling of buffer count checks within the dec_msg function. An integer overflow can occur when the num_buffers parameter is set to a specific high value, allowing the parser to exceed the bounds of the message buffer and potentially leading to memory corruption or denial of service. Organizations utilizing Linux systems with AMD GPU drivers should prioritize addressing this vulnerability to mitigate risks associated with potential exploitation.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression 6 + num_buffers * 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of the message BO. Triggering it additionally requires a ~4GiB mapping so that msg[1] survives the earlier "header does not fit in BO" check. Rewrite the test in division form, which is overflow-free by construction. Also update the message to reflect that msg is invalid.