Null Pointer Dereference in Linux Kernel's AMD Display Driver - CVE-2024-43886
Summary
DEBIAN-CVE-2024-43886: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null check in resource_log_pipe_topology_update [WHY] When switching from "Extend" to "Second Display Only" we sometimes call resou... Affects linux versions < 6.10.6-1. Fixed in 6.10.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages hardware resources and provides essential services for software applications. The kernel is known for its stability and performance, but vulnerabilities can arise, impacting system security and functionality. This specific vulnerability affects the AMD display driver within the kernel, which is responsible for managing graphics output and display configurations.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the AMD display driver, specifically in the resource_log_pipe_topology_update function. When switching display modes from 'Extend' to 'Second Display Only', the system may attempt to access a disconnected stream for the embedded DisplayPort (eDP). This results in a null pointer dereference, potentially leading to system crashes or instability. The vulnerability is critical as it can be exploited during normal user operations, affecting the overall user experience and system reliability.
How To Fix
Minimum fixed version
6.10.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to update to the patched version as soon as it becomes available to mitigate risks.
Conclusion
The vulnerability CVE-2024-43886 in the Linux kernel's AMD display driver poses a risk of system instability due to a null pointer dereference. Users are strongly encouraged to update to the patched version 6.10.6-1 to ensure system security and reliability. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2024-43886 is a vulnerability in the Linux kernel's AMD display driver that can lead to a null pointer dereference, causing system instability.
This vulnerability can cause crashes or instability when switching display modes, particularly when using the AMD display driver.
If you are using a version of the Linux kernel prior to 6.10.6-1, your system may be at risk. It is recommended to update to the latest version.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While there are no specific workarounds available, it is crucial to plan for an update as soon as possible to mitigate potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
