Description
libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to make is_all_zeroes read past the buffer, causing a possible crash.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| emersion | libdisplay-info | ≤ 0.4.0 | — |
References
- https://hackmd.io/@haindpwn/libdisplay-info-displayid-datablock-overrun-oob-read third-party-advisory
- https://gitlab.freedesktop.org/emersion/libdisplay-info/-/blob/0.4.0/displayid.c#L603-L689 technical-description
- https://gitlab.freedesktop.org/emersion/libdisplay-info product
- VulnCheck Advisory: libdisplay-info through 0.4.0 Heap Out-of-Bounds Read via DisplayID v1 Parser third-party-advisory