Null Pointer Dereference in Linux Kernel's AMD Display Driver - CVE-2024-49914
Summary
DEBIAN-CVE-2024-49914: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe This commit addresses a null pointer dereference issue in the dcn20_prog... Affects linux versions < 6.11.4-1. Fixed in 6.11.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It supports a wide range of functionalities, including process management, memory management, and device control. The vulnerability in question affects the AMD display driver within the kernel, specifically in the function responsible for programming display pipes. This issue can lead to system instability if not addressed promptly.
Vulnerability Detail
In the Linux kernel, a null pointer dereference vulnerability has been identified in the AMD display driver, specifically within the dcn20_program_pipe function. This issue arises when the pipe_ctx->plane_state is null, leading to potential crashes or undefined behavior when the system attempts to access this null reference. The vulnerability was reported by smatch and has been addressed in a recent commit that adds a necessary null check before accessing the plane_state.
How To Fix
Minimum fixed version
6.11.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the Linux kernel to the fixed version.
Conclusion
The null pointer dereference vulnerability in the Linux kernel's AMD display driver (CVE-2024-49914) poses a significant risk to system stability. Users are strongly advised to update their kernel to the patched version 6.11.4-1 to protect against potential crashes and undefined behavior. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2024-49914 is a vulnerability in the Linux kernel's AMD display driver that can lead to a null pointer dereference, potentially causing system crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to system instability, crashes, or undefined behavior when the affected function is called.
Yes, a patch is available in the form of the Linux kernel version 6.11.4-1 for Debian 13 and 14.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
