Critical Vulnerability in Linux Kernel: NULL Pointer Dereference in DPU Encoder
Summary
DEBIAN-CVE-2024-45015: In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable() For cases where the crtc's connectors_changed was set without enable/active gett... Affects linux versions < 6.10.7-1. Fixed in 6.10.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management, process scheduling, and system security. It is widely used across various platforms, including servers, desktops, and embedded systems. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically related to the Direct Rendering Manager (DRM) subsystem, which handles graphics rendering and display management.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the Direct Rendering Manager (DRM) subsystem, specifically within the msm/dpu encoder. The issue arises when the connector assignment for the dpu_encoder is not properly handled during the atomic_enable() process. If the crtc's connectors_changed flag is set without toggling the enable/active state, an atomic_enable() call is followed by an atomic_disable() without an atomic_mode_set(). This leads to a NULL pointer access during the dpu_encoder_get_drm_fmt() call, potentially causing system crashes or undefined behavior. The vulnerability is tracked under DEBIAN-CVE-2024-45015.
How To Fix
Minimum fixed version
6.10.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux package.
Conclusion
The identified vulnerability in the Linux kernel poses significant risks to system stability and security. It is crucial for users of Debian 13 and 14 to update their systems to the patched version 6.10.7-1 to mitigate these risks. Regular monitoring and prompt updates are essential for maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to a NULL pointer dereference, potentially causing system crashes or undefined behavior in applications relying on the DRM subsystem.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability affects the Linux kernel versions in Debian 13 and 14 prior to the patched version 6.10.7-1.
While the primary risk is system instability or crashes, there is a potential for data loss if the system crashes during critical operations.
If an immediate update is not possible, monitor your system for unusual behavior and consider isolating it from critical operations until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
