Null Pointer Dereference in Linux Kernel - AMDGPU Driver Vulnerability
Summary
DEBIAN-CVE-2024-26657: In the Linux kernel, the following vulnerability has been resolved: drm/sched: fix null-ptr-deref in init entity The bug can be triggered by sending an amdgpu_cs_wait_ioctl to the AMDGPU DRM driver on any ASICs with vali... Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. The 'linux' package in Debian is crucial for system operations, managing resources, and facilitating communication between hardware and applications. This vulnerability specifically affects the AMDGPU DRM driver, which is responsible for managing AMD graphics cards within the Linux environment.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the AMDGPU DRM driver, specifically related to the drm_sched_entity_init function. This issue arises when the AMDGPU_WAIT_CS ioctl is called without a previously submitted job, leading to a null pointer dereference. The bug can be triggered by sending an amdgpu_cs_wait_ioctl to the driver on any ASICs with a valid context. The modification in logic allowed sched_rq to be NULL, resulting in a successful return from the ioctl when it should have failed. This can lead to system instability and potential crashes, as evidenced by kernel panic messages indicating a NULL pointer dereference.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the patch as soon as it is available to mitigate risks.
Conclusion
The identified vulnerability in the Linux kernel's AMDGPU driver poses significant risks, including system crashes due to null pointer dereferences. Users are urged to update their systems to the patched version to ensure stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in open-source software.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes and instability due to a null pointer dereference in the AMDGPU driver.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, a patch is available in version 6.7.12-1 of the linux package. Users should update to this version or later.
While there are no specific workarounds, it is recommended to monitor your system closely and apply the patch as soon as possible.
The vulnerability was reported by Joonkyo Jung from Yonsei University.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
