CVE-2024-27040: drm/amd/display: Add 'replay' NULL check in 'edp_set_replay_allow_active()'
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Add 'replay' NULL check in 'edpsetreplayallowactive()'
In the first if statement, we're checking if 'replay' is NULL. But in the second if statement, we're not checking if 'replay' is NULL again before calling replay->funcs->replaysetpoweropt().
if (replay == NULL && forcestatic) return false;
...
if (link->replaysettings.replayfeatureenabled && replay->funcs->replaysetpoweropt) { replay->funcs->replaysetpoweropt(replay, poweropts, panelinst); link->replaysettings.replaypoweroptactive = poweropts; }
If 'replay' is NULL, this will cause a null pointer dereference.
Fixes the below found by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/linkedppanelcontrol.c:895 edpsetreplayallowactive() error: we previously assumed 'replay' could be null (see line 887)
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27040?
CVE-2024-27040 has a severity rating that reflects a potential impact on the integrity and availability of the Linux kernel, particularly within the AMD display driver.
How do I fix CVE-2024-27040?
To mitigate CVE-2024-27040, update your Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, or 6.12.10-1.
Which versions of Linux are affected by CVE-2024-27040?
CVE-2024-27040 affects specific versions of the Linux kernel including those prior to the patched versions indicated.
What could happen if CVE-2024-27040 is exploited?
Exploiting CVE-2024-27040 could potentially lead to denial of service or unexpected behavior in systems using the affected versions of the Linux kernel.
Is there a workaround for CVE-2024-27040?
Currently, the recommended action for CVE-2024-27040 is to apply the necessary updates rather than relying on workarounds.