Critical Vulnerability in Linux Kernel: Null Dereference in AMD DRM
Summary
DEBIAN-CVE-2024-49890: In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: ensure the fw_info is not null before using it This resolves the dereference null return value warning reported by Coverity. Affects linux versions < 5.10.234-1. Fixed in 5.10.234-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its robustness and flexibility, supporting a wide range of hardware architectures. However, like any complex software, it is susceptible to vulnerabilities that can compromise system security and stability. This specific vulnerability affects the AMD Direct Rendering Manager (DRM) within the kernel, which is responsible for managing graphics processing units (GPUs) and rendering graphics.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the AMD DRM subsystem where the firmware information (fw_info) can be null. This oversight can lead to a null dereference, potentially causing system crashes or undefined behavior. The vulnerability was reported by Coverity, highlighting the importance of ensuring that pointers are validated before use. This issue could affect systems relying on AMD graphics hardware, leading to instability and security risks.
How To Fix
Minimum fixed version
5.10.234-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected AMD graphics hardware or disable the AMD DRM module until the system is updated with the patched kernel. This can be done by running:
sudo modprobe -r amdgpu
Conclusion
The identified vulnerability in the Linux kernel's AMD DRM subsystem poses significant risks, including potential system crashes. Users are strongly advised to update their systems to the patched versions to mitigate these risks. For ongoing monitoring of vulnerabilities, tools like Vulert can provide real-time alerts.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes or undefined behavior due to null dereference in the AMD DRM subsystem.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The vulnerability affects various versions of the Linux kernel across Debian 11, 12, 13, and 14.
Yes, patches are available for the affected versions of the Linux kernel. Users should update to the specified patched versions.
If immediate updates are not possible, consider disabling the AMD DRM module as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
