Null Pointer Dereference Vulnerability in Linux Kernel - CVE-2024-43904
Summary
CVE-2024-43904: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null checks for 'stream' and 'plane' before dereferencing This commit adds null checks for the 'stream' and 'plane' variables in th... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It is known for its robustness and versatility, supporting a wide range of devices and architectures. However, like any complex software, it can be susceptible to vulnerabilities. CVE-2024-43904 specifically affects the AMD display driver within the kernel, where improper null checks can lead to system crashes.
Vulnerability Detail
CVE-2024-43904 is a vulnerability in the Linux kernel related to the AMD display driver. It arises from the lack of null checks for the 'stream' and 'plane' variables in the dcn30_apply_idle_power_optimizations function. This oversight could lead to a null pointer dereference, potentially causing a system crash. The vulnerability was identified during static code analysis, which highlighted that the code incorrectly assumed these variables would never be null, leading to instability in the system when they are.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the fix by updating the kernel as described above.
Conclusion
CVE-2024-43904 is a significant vulnerability in the Linux kernel that can lead to system crashes due to improper null checks in the AMD display driver. It is crucial for users to update their systems to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2024-43904 is a vulnerability in the Linux kernel that can lead to a system crash due to null pointer dereference in the AMD display driver.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your manifest file.
The CVSS score for CVE-2024-43904 is 5.5, indicating a moderate severity level.
While there are no specific workarounds, it is advisable to monitor your system for any unusual behavior and plan to update as soon as possible.
Yes, the vulnerability affects multiple Debian versions, including Debian 11, 12, and 13. Ensure you are using a patched version.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
