CVE-2024-49905: drm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2)
drm/amd/display: Add null check for 'afb' in amdgpudmplanehandlecursorupdate (v2)
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.56.1-5 - Configuration
Update the Linux kernel drm/amd/display code to add a null check for the 'afb' variable specifically at the line(s) where 'afb' is used within amdgpu_dm_plane_handle_cursor_update (v2), addressing the previous assumption that 'afb' could be null and its later use without a null check.
Linux kernel (drm/amd/display) Null-check handling for 'afb' in amdgpu_dm_plane_handle_cursor_update() = Add null check at the point of 'afb' usage in drivers/gpu/drm/amd/../display/amdgpu_dm/amdgpu_dm_plane.c
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49905?
CVE-2024-49905 has been classified as a moderate severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-49905?
To resolve CVE-2024-49905, update your Linux kernel to versions 6.1.123-1, 6.1.119-1, 6.12.11-1, or 6.12.12-1 or later.
Which Linux kernel versions are affected by CVE-2024-49905?
CVE-2024-49905 affects multiple Linux kernel versions ranging from 5.10.223-1 to 6.11.3, including specific versions of 6.2 and 6.6.
What is the nature of the vulnerability in CVE-2024-49905?
CVE-2024-49905 addresses a null pointer dereference vulnerability due to a missing null check in the amdgpu_dm_plane_handle_cursor_update function.
Is CVE-2024-49905 a local or remote exploit?
CVE-2024-49905 can be exploited locally, as it involves a function within the Linux kernel that can be triggered by user-space applications.