Null Pointer Dereference in Linux Kernel's AMD Display Driver - CVE-2024-49923
Summary
DEBIAN-CVE-2024-49923: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags [WHAT & HOW] "dcn20_validate_apply_pipe_split_flags" dereferences merge, and thu... Affects linux versions < 6.11.4-1. Fixed in 6.11.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It supports a wide range of hardware architectures and is known for its stability and performance. The vulnerability in question affects the AMD display driver within the kernel, specifically in the function responsible for validating pipe split flags, which is critical for rendering graphics correctly.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the AMD display driver where the function 'dcn20_validate_apply_pipe_split_flags' dereferences a potentially null pointer. This can lead to a null pointer dereference, causing the system to crash or behave unpredictably. The issue arises from the failure to ensure that a valid pointer is passed to the function, which can result in significant system instability and security risks if exploited.
How To Fix
Minimum fixed version
6.11.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2024-49923 is a critical vulnerability affecting the Linux kernel's AMD display driver, which can lead to serious system instability. Users are advised to update their kernel to the latest patched version to ensure their systems remain secure. Regular monitoring with tools like Vulert can help in identifying such vulnerabilities promptly.
See every vulnerability recorded for linux →
FAQ
CVE-2024-49923 is a vulnerability in the Linux kernel's AMD display driver that can lead to a null pointer dereference.
This vulnerability can cause system crashes or unpredictable behavior, potentially leading to data loss or security breaches.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, the patched versions are 6.11.4-1 for both Debian 13 and Debian 14. Users should update their kernel to this version.
While there are no specific workarounds, it is crucial to prioritize updating your kernel to mitigate the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
