Kernel NULL Pointer Dereference in Linux Kernel - CVE-2024-43899
Summary
CVE-2024-43899: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix null pointer deref in dcn20_resource.c Fixes a hang thats triggered when MPV is run on a DCN401 dGPU: mpv --hwdec=vaapi --vo=gpu --... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of Linux operating systems, managing hardware resources and providing essential services for software applications. It supports a wide range of hardware architectures and is known for its stability and performance. However, vulnerabilities can arise, such as CVE-2024-43899, which affects the graphics driver subsystem, specifically the AMD GPU driver, leading to potential system hangs during video playback.
Vulnerability Detail
CVE-2024-43899 is a vulnerability in the Linux kernel's AMD graphics driver that can cause a kernel NULL pointer dereference. This issue occurs when the MPV media player is used with hardware acceleration and fullscreen playback is enabled. The result is a system hang, as indicated by a call trace showing a NULL pointer dereference. This vulnerability can lead to a denial of service, affecting system stability and user experience.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid triggering the vulnerability by refraining from using the MPV media player with the specified hardware acceleration and fullscreen playback options. Instead, users can use software rendering or other media players that do not invoke this specific driver issue.
Conclusion
CVE-2024-43899 is a significant vulnerability in the Linux kernel's AMD graphics driver that can lead to system instability during video playback. Users are advised to update their kernel to mitigate this issue and can utilize Vulert to monitor for similar vulnerabilities in their software.
See every vulnerability recorded for linux →
FAQ
CVE-2024-43899 is a vulnerability in the Linux kernel's AMD graphics driver that can cause a kernel NULL pointer dereference, leading to system hangs during video playback.
This vulnerability can lead to a denial of service, causing your system to hang when using specific video playback settings with the MPV media player.
You should update your Linux kernel to a version that includes the patch for CVE-2024-43899. Follow the provided steps to upgrade your kernel.
Yes, you can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can also check your application in the Vulert playground without signing up.
The CVSS score of CVE-2024-43899 is 5.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
