CVE-2021-47046

What it actually does

Off-by-one read overflow when accessing hdcp_i2c_offsets[] beyond its bounds for HDCP_MESSAGE_ID_WRITE_CONTENT_STREAM_TYPE in the AMD display driver's hdmi_14_process_transaction function.

Why it matters to the business

On AMD GPU systems, an attacker with local access could trigger a kernel memory read outside array limits, risking crashes, information disclosure, or denial of service on affected Linux kernels.

How an attack unfolds

An attacker with local access crafts or triggers an HDCP transaction using the missing message ID, causing the driver to index one element past the end of the offsets array and read adjacent kernel memory.

How to fix it

Update the Linux kernel to a version containing the upstream fix that adds the missing array entry and declares arrays with HDCP_MESSAGE_ID_MAX size; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the presence of the added offset entry for HDCP_MESSAGE_ID_WRITE_CONTENT_STREAM_TYPE and the HDCP_MESSAGE_ID_MAX array sizing in drivers/gpu/drm/amd/display/ and the hdcp module; verify via kernel source or running kernel version checks against fixed releases.

Typical attack path

1. Obtain local access on a Linux system with AMD display hardware
2. Trigger HDCP processing that invokes hdmi_14_process_transaction with HDCP_MESSAGE_ID_WRITE_CONTENT_STREAM_TYPE
3. Cause out-of-bounds array read to leak or corrupt adjacent kernel memory
4. Escalate to denial of service or further exploitation if useful data is obtained

How to detect it

Review kernel logs for AMD display or HDCP related oops/panic messages around array access; inspect for unusual process activity invoking display drivers; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates on all AMD GPU hosts within standard patch windows given low EPSS and lack of KEV listing
• Audit systems for custom or out-of-tree AMD display drivers that may still contain the vulnerable array definitions
• Monitor for future similar off-by-one issues in HDCP handling code