Race Condition Vulnerability in Linux Kernel's AMD Display Driver
Summary
DEBIAN-CVE-2024-46850: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid race between dcn35_set_drr() and dc_state_destruct() dc_state_destruct() nulls the resource context of the DC state. Affects linux versions < 6.10.11-1. Fixed in 6.10.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. The 'linux' package in Debian distributions is crucial for system stability and performance. This vulnerability affects the AMD display driver within the kernel, specifically in the handling of resource contexts, which can lead to instability if exploited.
Vulnerability Detail
In the Linux kernel, a race condition exists between the functions dcn35_set_drr() and dc_state_destruct(). When dc_state_destruct() is executed concurrently with IRQ processing, it can nullify the resource context of the DC state while dcn35_set_drr() attempts to access it. This can lead to the use of already nulled function callback fields, resulting in unpredictable behavior or crashes. The vulnerability arises from insufficient synchronization between these operations, making it critical to address.
How To Fix
Minimum fixed version
6.10.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the IRQ processing does not overlap with the execution of dc_state_destruct() by implementing proper locking mechanisms in your code, if applicable.
Conclusion
The identified race condition vulnerability in the Linux kernel's AMD display driver poses a significant risk to system stability. It is essential to update to the patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for linux →
FAQ
A race condition occurs when two or more processes access shared data and try to change it at the same time. If the processes are not synchronized, it can lead to unpredictable results.
Exploitation of this vulnerability could lead to system instability, crashes, or unexpected behavior in applications that rely on the AMD display driver.
If you are using Debian 13 or 14 with the affected version of the Linux kernel, your system may be vulnerable. You can check your kernel version using the command 'uname -r'.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. Visit https://vulert.com for more information.
If an immediate update is not possible, consider applying the suggested workaround to minimize the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
