Double Free Vulnerability in Linux Kernel's AMDGPU Package
Summary
CVE-2024-42123: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix double free err_addr pointer warnings In amdgpu_umc_bad_page_polling_timeout, the amdgpu_umc_handle_bad_pages will be run many times so... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. The AMDGPU driver is a part of the kernel that manages AMD graphics cards, enabling optimal performance and functionality. This driver is crucial for systems using AMD hardware, as it ensures proper communication between the operating system and the graphics card. However, vulnerabilities in the kernel can lead to severe security risks, including system crashes and unauthorized access.
Vulnerability Detail
In the Linux kernel, specifically within the AMDGPU driver, a vulnerability has been identified that leads to a double free error with the err_addr pointer. This issue arises in the amdgpu_umc_bad_page_polling_timeout function, where the amdgpu_umc_handle_bad_pages is executed multiple times. If not addressed, this can result in memory corruption and potential exploitation by attackers, leading to system instability or unauthorized access. The vulnerability has been assigned a CVSS score of 5.5, indicating a moderate level of risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the necessary updates as outlined in the 'how_to_fix' section.
Conclusion
The CVE-2024-42123 vulnerability in the Linux kernel's AMDGPU driver poses a moderate risk due to a double free error that can lead to system instability. Users are advised to update their systems promptly to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2024-42123 is a vulnerability in the Linux kernel's AMDGPU driver that can lead to a double free error, potentially causing system instability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.5, indicating a moderate risk level.
While there are no specific workarounds, it is crucial to prioritize updating your kernel as soon as possible to mitigate the risk.
More details can be found in the official CVE database or through the provided source links in the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
