CVE-2022-49365: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49365 is a vulnerability in the Linux kernel affecting the AMD GPU driver (drm/amdgpu). The issue was discovered in the dm_dmub_outbox1_low_irq() function where an off-by-one error in array bounds checking could lead to an out-of-bounds access. The vulnerability was resolved by correcting the comparison operator from '>' to '>=' when checking against ARRAY_SIZE() (Kernel Git).

The vulnerability exists in the AMD GPU driver's display management code. Specifically, the issue occurs in the dm_dmub_outbox1_low_irq() function where the condition 'notify.type > ARRAY_SIZE(dm->dmub_thread_offload)' was incorrectly used instead of 'notify.type >= ARRAY_SIZE(dm->dmub_thread_offload)'. This incorrect boundary check could potentially allow access beyond the array bounds (Kernel Git).

The vulnerability could potentially lead to an out-of-bounds memory access in the Linux kernel's AMD GPU driver. This could result in memory corruption or system instability when processing certain GPU operations (NVD).

The vulnerability requires local access to a system with an AMD GPU using the affected driver code. It can be triggered through the GPU driver's interrupt handling mechanism (Debian Tracker).

The issue has been fixed in the Linux kernel through a patch that corrects the array bounds checking logic. The fix involves changing the comparison operator from '>' to '>=' in the dm_dmub_outbox1_low_irq() function. Systems should be updated to include this patch (Kernel Git).