Critical Vulnerability in Linux Kernel: drm/amd/display ASSERT Issue
Summary
DEBIAN-CVE-2024-42117: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: ASSERT when failing to find index by plane/stream id [WHY] find_disp_cfg_idx_by_plane_id and find_disp_cfg_idx_by_stream_id returns an... Affects linux versions < 6.9.9-1. Fixed in 6.9.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is widely used across various platforms, including servers, desktops, and embedded systems. The kernel's stability and security are paramount, as vulnerabilities can lead to system crashes, data loss, or unauthorized access. This specific vulnerability affects the drm/amd/display subsystem, which is responsible for managing display outputs in AMD graphics hardware.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the drm/amd/display subsystem, where the functions find_disp_cfg_idx_by_plane_id and find_disp_cfg_idx_by_stream_id can return an invalid index of -1 when a valid index is not found. This situation triggers an ASSERT() call, which is intended to prevent further processing with an invalid index. However, the return of -1 can lead to potential overrun and negative return issues, as reported by Coverity. The ramifications of this vulnerability include possible system instability and crashes when the affected functions are invoked.
How To Fix
Minimum fixed version
6.9.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. It is recommended to apply the patch as soon as it becomes available.
Conclusion
The identified vulnerability in the Linux kernel's drm/amd/display subsystem poses significant risks to system stability and security. Users are strongly encouraged to update to the patched version 6.9.9-1 to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain software security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves an assertion failure in the drm/amd/display subsystem of the Linux kernel, which can lead to invalid index returns and potential system instability.
The vulnerability affects the Linux kernel versions prior to 6.9.9-1 in both Debian 13 and Debian 14.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
While no specific workarounds are available, it is advisable to prioritize updating your kernel to mitigate the risk associated with this vulnerability.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-42117.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
