Jesse Zhang

The issue arises when user space sets an invalid ta type, resulting in an empty pointer context. To prevent dereferencing a null pointer, it is necessary to check the pointer context before using it.

The issue is related to an out-of-bounds read warning in the Linux kernel, specifically in the drm/amd/pm module. This warning occurs when using index i - 1U, which may exceed the element index for mc data[] when i = 0. The vulnerability is also associated with the function atomctrl retrieve ac timing() in the module drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c, which is related to reading memory beyond the allocated buffer. Exploitation of this issue may allow an attacker to impact the confidentiality and availability of protected information.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to the use of an uninitialized value `*size` when calling `amdgpu vce cs reloc` in the `drm/amdgpu` module. This could potentially impact the confidentiality, integrity, and availability of protected information. The problem can be addressed by initializing the `size` before calling `amdgpu vce cs reloc`, such as in the case `0x03000001`. To improve handling, a separate value of `0xffffffff` would be needed. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The vulnerability is related to a shift out-of-bounds issue in the drm/amdkfd component of the Linux kernel. This issue can cause a denial of service. The vulnerability is caused by a shift exponent of 255 being too large for a 64-bit type 'long unsigned int'.