CVE-2024-38546: drm: vc4: Fix possible null pointer dereference
In the Linux kernel, the following vulnerability has been resolved:
drm: vc4: Fix possible null pointer dereference
In vc4hdmiaudioinit() ofgetaddress() may return NULL which is later dereferenced. Fix this bug by adding NULL check.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.94-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.8.12-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
Add a NULL check in vc4_hdmi_audio_init() before dereferencing the value returned by of_get_address().
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38546?
CVE-2024-38546 has a medium severity rating due to the potential for a null pointer dereference that can affect system stability.
How do I fix CVE-2024-38546?
To fix CVE-2024-38546, update the Linux kernel to version 5.10.223-1, 6.1.123-1, or any other patched version listed in the official release notes.
What systems are affected by CVE-2024-38546?
CVE-2024-38546 affects multiple versions of the Linux kernel, specifically versions between 4.12 and 6.9.
Is there a workaround for CVE-2024-38546?
There is no specific workaround for CVE-2024-38546; updating the kernel is the recommended mitigation.
Who discovered CVE-2024-38546?
CVE-2024-38546 was discovered by the Linux Verification Center, highlighting a bug in the handling of HDMI audio initialization.