Kernel NULL Pointer Dereference in Linux Packages: CVE-2024-43901
Summary
CVE-2024-43901: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference for DTN log in DCN401 When users run the command: cat /sys/kernel/debug/dri/0/amdgpu_dm_dtn_log The follow... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the operating system, including process management, memory management, and device control. The vulnerability CVE-2024-43901 affects the AMD GPU driver within the Linux kernel, specifically in the display component, where a NULL pointer dereference can occur when accessing the DTN log.
Vulnerability Detail
CVE-2024-43901 is a vulnerability in the Linux kernel related to the AMD GPU driver. It arises when users execute the command 'cat /sys/kernel/debug/dri/0/amdgpu_dm_dtn_log', leading to a NULL pointer dereference. This issue occurs because the color log attempts to read gamut remap information from DCN401, which is not initialized in the dcn401_dpp_funcs. The ramifications of this vulnerability include potential system crashes or instability, as the kernel attempts to access an uninitialized memory address, resulting in a kernel panic.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid executing the command 'cat /sys/kernel/debug/dri/0/amdgpu_dm_dtn_log' until the kernel is updated. This will prevent the NULL pointer dereference from occurring.
Conclusion
CVE-2024-43901 is a significant vulnerability in the Linux kernel affecting AMD GPU drivers, leading to potential system crashes due to a NULL pointer dereference. Users are advised to update their kernels promptly to mitigate this risk and avoid executing the problematic command until a fix is applied.
See every vulnerability recorded for linux →
FAQ
CVE-2024-43901 is a vulnerability in the Linux kernel that can lead to a NULL pointer dereference when accessing the AMD GPU DTN log.
This vulnerability can cause system crashes or instability, as it leads to a kernel panic when the uninitialized memory address is accessed.
The vulnerability affects Linux packages in Debian 11, 12, and 13, particularly those using the AMD GPU driver.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for CVE-2024-43901 is 5.5, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
