Linux Kernel up to 6.7.6 display dc_dmub_srv_cmd_list_queue_execute dc_dmub_srv null pointer dereference

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.7.6. It has been rated as critical. Impacted is the function dc_dmub_srv_cmd_list_queue_execute of the component display. This manipulation of the argument dc_dmub_srv causes null pointer dereference. This vulnerability is handled as CVE-2024-26729. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 6.7.6 and classified as critical. Affected by this vulnerability is the function dc_dmub_srv_cmd_list_queue_execute of the component display. The manipulation of the argument dc_dmub_srv with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential null pointer dereference in dc_dmub_srv Fixes potential null pointer dereference warnings in the dc_dmub_srv_cmd_list_queue_execute() and dc_dmub_srv_is_hw_pwr_up() functions. In both functions, the 'dc_dmub_srv' variable was being dereferenced before it was checked for null. This could lead to a null pointer dereference if 'dc_dmub_srv' is null. The fix is to check if 'dc_dmub_srv' is null before dereferencing it. Thus moving the null checks for 'dc_dmub_srv' to the beginning of the functions to ensure that 'dc_dmub_srv' is not null when it is dereferenced. Found by smatch & thus fixing the below: drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:133 dc_dmub_srv_cmd_list_queue_execute() warn: variable dereferenced before check 'dc_dmub_srv' (see line 128) drivers/gpu/drm/amd/amdgpu/../display/dc/dc_dmub_srv.c:1167 dc_dmub_srv_is_hw_pwr_up() warn: variable dereferenced before check 'dc_dmub_srv' (see line 1164)

It is possible to read the advisory at git.kernel.org. This vulnerability is known as CVE-2024-26729 since 02/19/2024. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 6.7.7 or 6.8 eliminates this vulnerability. Applying the patch 351080ba3414/d2b48f340d9e is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2024-0773). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• IBM InfoSphere Guardium
• Oracle Linux
• NetApp FAS
• EMC Avamar
• Oracle VM
• NetApp AFF
• Dell NetWorker
• IBM Security Guardium
• RESF Rocky Linux
• Open Source Linux Kernel
• SolarWinds Security Event Manager
• Broadcom Brocade SANnav
• IBM Business Automation Workflow
• IBM Spectrum Protect Plus
• IBM QRadar SIEM
• Juniper Junos Space
• IBM DB2
• IBM Storage Scale System

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.7.0
• 6.7.1
• 6.7.2
• 6.7.3
• 6.7.4
• 6.7.5
• 6.7.6

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion