Null Pointer Dereference in Linux Kernel's AMD Display Driver
Summary
DEBIAN-CVE-2024-27040: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add 'replay' NULL check in 'edp_set_replay_allow_active()' In the first if statement, we're checking if 'replay' is NULL. Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resource allocation. The AMD display driver is part of the kernel's graphics subsystem, enabling the functionality of AMD graphics cards. This driver is crucial for rendering graphics and managing display settings. The vulnerability in question arises from a failure to properly check for null pointers, which can lead to system instability and crashes.
Vulnerability Detail
In the Linux kernel, specifically within the AMD display driver, a vulnerability has been identified where a null pointer dereference can occur. This issue arises in the function 'edp_set_replay_allow_active()', where the code checks if the 'replay' variable is null in one instance but fails to do so in another before invoking 'replay->funcs->replay_set_power_opt()'. If 'replay' is null, this leads to a dereference error, potentially causing system crashes or unexpected behavior. The vulnerability was highlighted by static analysis tools like smatch, indicating that the assumption about 'replay' being non-null was incorrect.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package as described above.
Conclusion
The identified null pointer dereference vulnerability in the Linux kernel's AMD display driver poses significant risks to system stability. It is crucial for users to update their systems to the patched version to mitigate these risks. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain system security.
See every vulnerability recorded for linux →
FAQ
A null pointer dereference occurs when a program attempts to access or modify data through a pointer that is null, leading to crashes or undefined behavior.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The primary risk is system instability, which can lead to crashes, data loss, or other unexpected behaviors during operation.
Yes, this vulnerability affects specific versions of the Linux kernel, particularly those prior to the patched version 6.7.12-1.
If immediate updates are not possible, consider isolating affected systems from critical networks and monitoring for unusual behavior until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
