Kernel Vulnerability in Linux Package: UBSAN Warning in DML2.1
Summary
DEBIAN-CVE-2024-50177: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix a UBSAN warning in DML2.1 When programming phantom pipe, since cursor_width is explicity set to 0, this causes calculation logic to... Affects linux versions < 6.11.4-1. Fixed in 6.11.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential functionalities for system operations, including process management, memory management, and device control. This vulnerability affects versions of the Linux kernel in Debian 13 and 14, specifically related to the AMD display driver, which can lead to system instability and potential exploitation.
Vulnerability Detail
The vulnerability arises from an overflow condition triggered by an improper calculation in the AMD display driver when programming a phantom pipe. Specifically, the cursor width is set to zero, leading to a shift-out-of-bounds error for an unsigned integer. This issue is detected by the kernel's Undefined Behavior Sanitizer (UBSAN), which can result in unexpected behavior or crashes, potentially allowing an attacker to exploit the system.
How To Fix
Minimum fixed version
6.11.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the Linux package as described above.
Conclusion
The vulnerability identified in the Linux package related to the AMD display driver poses a significant risk to system stability and security. Users are encouraged to update their systems to the patched version to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a shift-out-of-bounds error in the AMD display driver, which can lead to system crashes or instability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to system crashes, instability, or unauthorized access, depending on the attacker's capabilities.
Yes, a patch is available in version 6.11.4-1 of the Linux package for both Debian 13 and 14.
While there are no specific workarounds, it is advisable to monitor your system for unusual behavior and apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
