DMCUB Timeout Vulnerability in Linux Kernel - Affects Debian Packages
Summary
CVE-2024-46870: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Disable DMCUB timeout for DCN35 [Why] DMCUB can intermittently take longer than expected to process commands. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages system resources and hardware interactions, providing essential services for software applications. The kernel is critical for system stability and performance. This vulnerability specifically impacts the display management component of the kernel, particularly in AMD graphics processing units (GPUs), where it can lead to system hangs and undefined display states.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the display management component for AMD GPUs, specifically related to the DMCUB (Display Microcontroller Unit Block). The issue arises when DMCUB takes longer than expected to process commands, leading to a race condition. This race condition can occur when the system attempts to access the DCN (Display Core Next) state while it is inaccessible, potentially causing system hangs or undefined display configurations. The vulnerability is particularly concerning for systems with Integrated Power Supply (IPS) as it can exacerbate the timing issues.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to monitor their systems for any unusual behavior and consider disabling certain features that may trigger the DMCUB timeout until a patch is applied.
Conclusion
The DMCUB timeout vulnerability in the Linux kernel poses a significant risk to systems utilizing AMD GPUs, particularly those with Integrated Power Supply. It is crucial for users to update their systems to the patched version to mitigate potential issues. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
It is a vulnerability in the Linux kernel related to the display management for AMD GPUs, where the DMCUB can take longer than expected to process commands, leading to potential system hangs.
If your system is affected, you may experience system hangs or undefined display states, particularly when using AMD GPUs with Integrated Power Supply.
Yes, a patch is available for Debian 13 in version 6.10.9-1. Users of Debian 11 and 12 should check for updates as patches may be released.
While there are no specific workarounds, it is advisable to monitor your system for unusual behavior and consider disabling features that may trigger the DMCUB timeout.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities without needing to install any software.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
