CVE-2024-27042: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-27042 is a vulnerability discovered in the Linux kernel affecting the AMD GPU driver (amdgpu). The issue was identified in the amdgpu_discovery_reg_base_init() function where an out-of-bounds access could occur when accessing the array 'adev->vcn.vcn_config' before checking if the index 'adev->vcn.num_vcn_inst' is within the bounds of the array. The vulnerability affects Linux kernel versions from 5.19 up to (excluding) 6.6.23, from 6.7 up to (excluding) 6.7.11, and from 6.8 up to (excluding) 6.8.2 (NVD).

The vulnerability is classified as CWE-129 (Improper Validation of Array Index) with a CVSS v3.1 base score of 7.8 (HIGH). The technical issue occurs in the drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c file where array bounds checking was performed after array access, potentially leading to out-of-bounds memory access. The vulnerability requires local access and low privileges to exploit (NVD).

The vulnerability could lead to a system crash if exploited, as it involves improper array index validation that could result in accessing memory outside the intended bounds. This could potentially affect system stability and security on systems running the affected Linux kernel versions with AMD GPU hardware (Rapid7).

The vulnerability requires local access with low privileges to exploit. No known exploits in the wild have been reported at the time of assessment. The attack complexity is considered low, but requires authenticated local access to the system (NVD).

The fix involves moving the bounds check before the array access in the amdgpu_discovery_reg_base_init() function. This ensures that 'adev->vcn.num_vcn_inst' is within the bounds of the array before it is used as an index. The patch has been merged into the Linux kernel, and users are advised to upgrade to kernel versions 6.6.23, 6.7.11, or 6.8.2 or later to address this vulnerability (Kernel Git).