Null Pointer Dereference Vulnerability in Linux Kernel's AMD Display Driver
Summary
DEBIAN-CVE-2024-26662: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()' 'panel_cntl' structure used to control the display panel could be null,... Affects linux versions < 6.7.7-1. Fixed in 6.7.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. The 'linux' package in Debian versions 13 and 14 includes drivers for various hardware components, including graphics processing units (GPUs). This specific vulnerability affects the AMD display driver, which is responsible for managing display outputs and backlight levels. The vulnerability arises from a potential null pointer dereference in the driver code, which could lead to system instability or crashes.
Vulnerability Detail
In the Linux kernel, specifically within the AMD display driver, there exists a vulnerability where the 'panel_cntl' structure, used to control the display panel, could be null. This situation can lead to a null pointer dereference when the code attempts to access this structure in the function 'dcn21_set_backlight_level()'. The issue originates from an assumption in the code that 'panel_cntl' would always be valid, which is not guaranteed. If exploited, this vulnerability could cause crashes or unexpected behavior in systems utilizing affected AMD graphics hardware.
How To Fix
Minimum fixed version
6.7.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package as described above.
Conclusion
The null pointer dereference vulnerability in the Linux kernel's AMD display driver poses a risk of system instability. Users are strongly encouraged to update their 'linux' package to the patched version 6.7.7-1 to mitigate this risk. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a null pointer dereference in the AMD display driver of the Linux kernel, which can lead to system crashes.
The vulnerability affects the 'linux' package in Debian versions 13 and 14.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While there are no specific workarounds, it is advisable to monitor your system for any unusual behavior and apply the update as soon as possible.
Detailed information about the vulnerability can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-26662.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
