CVE-2024-40988: drm/radeon: fix UBSAN warning in kv_dpm.c
In the Linux kernel, the following vulnerability has been resolved:
drm/radeon: fix UBSAN warning in kvdpm.c
Adds bounds check for sumovidmappingentry.
Other sources
Linux Kernel is vulnerable to a denial of service, caused by UBSAN Warning in Kvdpm.C. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.19.317 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.4.279 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.221 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.162 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.96 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.36 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9.7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40988?
CVE-2024-40988 has been classified as a moderate severity vulnerability.
How do I fix CVE-2024-40988?
To fix CVE-2024-40988, upgrade your Linux kernel to one of the following versions: 4.19.317, 5.4.279, 5.10.221, 5.15.162, 6.1.96, 6.6.36, 6.9.7, 6.10, or any patched Debian Linux versions.
Which Linux kernel versions are affected by CVE-2024-40988?
CVE-2024-40988 affects multiple versions of the Linux kernel prior to the prescribed remedial updates.
Is there a workaround for CVE-2024-40988?
Currently, no specific workaround is mentioned for CVE-2024-40988 other than applying the recommended updates.
What impact does CVE-2024-40988 have on system performance?
CVE-2024-40988 primarily addresses a bounds checking issue that could potentially lead to system instability, but does not inherently affect system performance.