Critical Vulnerability in Linux Kernel: Null Pointer Dereference in DRM/MSM/Adreno
Summary
DEBIAN-CVE-2024-49901: In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs There are some cases, such as the one uncovered by Commit 46d4efcccc68 ("drm/msm/a6xx: Av... Affects linux versions < 6.11.4-1. Fixed in 6.11.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages hardware resources and provides essential services for software applications. The kernel is known for its stability and performance, but like any complex software, it can have vulnerabilities. This specific vulnerability affects the DRM (Direct Rendering Manager) subsystem for the MSM (Mobile Station Modem) and Adreno graphics processing units, which are crucial for rendering graphics on devices using these components.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the DRM/MSM/Adreno subsystem, where the 'msm_gpu->pdev' pointer is not assigned early enough during the GPU initialization process. This can lead to a null pointer dereference, causing system instability or crashes. The issue was uncovered in a specific commit that aimed to prevent dereferencing a null pointer when speedbin settings fail. The vulnerability arises from multiple initialization paths that can leave the pointer unassigned, leading to potential exploitation.
How To Fix
Minimum fixed version
6.11.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux kernel.
Conclusion
The identified vulnerability in the Linux kernel's DRM/MSM/Adreno subsystem poses a significant risk due to potential null pointer dereferences. It is essential for users to update their systems to the patched version to ensure stability and security. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the integrity of your software.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes or instability due to null pointer dereferences in the GPU initialization process.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, a patch is available in the form of the Linux kernel version 6.11.4-1 for both Debian 13 and 14.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk of exploitation.
You can find detailed information in the Debian CVE database or through the patchwork link provided in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
