CVE-2024-44967: drm/mgag200: Bind I2C lifetime to DRM device
In the Linux kernel, the following vulnerability has been resolved:
drm/mgag200: Bind I2C lifetime to DRM device
Managed cleanup with devmaddactionorreset() will release the I2C adapter when the underlying Linux device goes away. But the connector still refers to it, so this cleanup leaves behind a stale pointer in struct drmconnector.ddc.
Bind the lifetime of the I2C adapter to the connector's lifetime by using DRM's managed release. When the DRM device goes away (after the Linux device) DRM will first clean up the connector and then clean up the I2C adapter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-44967?
CVE-2024-44967 is classified with a severity rating that indicates a potential vulnerability in the Linux kernel's DRM subsystem.
How do I fix CVE-2024-44967?
To fix CVE-2024-44967, update to a patched version of the Linux kernel that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-44967?
CVE-2024-44967 affects certain versions of the Linux kernel including those between 6.0 and 6.1.105, 6.2 and 6.6.46, and 6.7 and 6.10.5.
What components are involved in CVE-2024-44967?
CVE-2024-44967 involves the I2C adapter and DRM device management within the Linux kernel.
Who is the vendor of the software affected by CVE-2024-44967?
The vendor of the affected software is Linux, specifically the Linux kernel developers responsible for updates.