Potential NULL Dereference in Linux Kernel's DRM Mediatek Package
Summary
DEBIAN-CVE-2024-53056: In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() In mtk_crtc_create(), if the call to mbox_request_channel() fails then we set the "mt... Affects linux versions < 6.11.7-1. Fixed in 6.11.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing the essential interface between hardware and software. It is known for its stability, performance, and versatility, supporting a wide range of hardware architectures. The DRM (Direct Rendering Manager) subsystem in the Linux kernel is responsible for managing graphics processing units (GPUs) and their associated resources. This vulnerability affects the Mediatek implementation within the DRM subsystem, which is used in various devices for graphics rendering.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the DRM Mediatek component, specifically in the mtk_crtc_destroy() function. If the call to mbox_request_channel() fails during the creation of a command queue, the 'mtk_crtc->cmdq_client.chan' pointer is set to NULL. This leads to a situation where cmdq_pkt_destroy() is called without a prior successful call to cmdq_pkt_create(), resulting in a potential NULL pointer dereference. This flaw could lead to system crashes or instability, impacting the overall reliability of the affected systems.
How To Fix
Minimum fixed version
6.11.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate any risks associated with this issue.
Conclusion
The identified vulnerability in the Linux kernel's DRM Mediatek component poses a significant risk of system instability due to a potential NULL dereference. Users are advised to update their systems to the patched version to mitigate this risk. Utilizing tools like Vulert can enhance your ability to monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a potential NULL dereference in the DRM Mediatek component of the Linux kernel, which can lead to system crashes.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Update your Linux kernel package to version 6.11.7-1 or later using your package manager.
While the primary risk is system instability, it is always advisable to back up important data before applying updates or patches.
Vulert monitors open-source vulnerabilities in your software using a manifest file like package-lock.json, providing real-time alerts without requiring code access.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
