Null Pointer Dereference in Linux Kernel's AMDGPU Driver
Summary
CVE-2024-43909: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: Fix the null pointer dereference for smu7 optimize the code to avoid pass a null pointer (hwmgr->backend) to function smu7_update_edc_lea... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. The AMDGPU driver is responsible for managing AMD graphics cards, enabling high-performance graphics rendering. This driver is critical for users relying on AMD hardware for gaming, graphics design, and computational tasks. The vulnerability in question arises from a null pointer dereference in the power management component of the AMDGPU driver, which could lead to system instability or crashes.
Vulnerability Detail
The vulnerability, identified as CVE-2024-43909, originates from a coding oversight in the AMDGPU driver where a null pointer (hwmgr->backend) is passed to the function smu7_update_edc_leakage_table. This can lead to a null pointer dereference, causing the system to crash or become unresponsive. The potential ramifications include loss of data, system downtime, and a negative impact on user experience, particularly for those utilizing AMD graphics hardware in critical applications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the kernel updates as soon as they are available.
Conclusion
CVE-2024-43909 is a significant vulnerability in the Linux kernel's AMDGPU driver that can lead to system instability due to a null pointer dereference. Users are advised to update their kernels to the latest versions to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2024-43909 is a vulnerability in the Linux kernel's AMDGPU driver that can lead to a null pointer dereference, potentially causing system crashes.
You can use Vulert to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to monitor for vulnerabilities.
The consequences include potential system crashes, data loss, and a negative impact on user experience, especially for those using AMD graphics hardware.
Yes, the CVSS score for CVE-2024-43909 is 5.5, indicating a moderate severity level.
This vulnerability was published on August 26, 2024.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
