CVE-2024-50117: drm/amd: Guard against bad data for ATIF ACPI method
In the Linux kernel, the following vulnerability has been resolved:
drm/amd: Guard against bad data for ATIF ACPI method
If a BIOS provides bad data in response to an ATIF method call this causes a NULL pointer dereference in the caller.
? showregs (arch/x86/kernel/dumpstack.c:478 (discriminator 1)) ? die (arch/x86/kernel/dumpstack.c:423 arch/x86/kernel/dumpstack.c:434) ? pagefaultoops (arch/x86/mm/fault.c:544 (discriminator 2) arch/x86/mm/fault.c:705 (discriminator 2)) ? douseraddrfault (arch/x86/mm/fault.c:440 (discriminator 1) arch/x86/mm/fault.c:1232 (discriminator 1)) ? acpiutupdateobjectreference (drivers/acpi/acpica/utdelete.c:642) ? excpagefault (arch/x86/mm/fault.c:1542) ? asmexcpagefault (./arch/x86/include/asm/idtentry.h:623) ? amdgpuatifquerybacklightcaps.constprop.0 (drivers/gpu/drm/amd/amdgpu/amdgpuacpi.c:387 (discriminator 2)) amdgpu ? amdgpuatifquerybacklightcaps.constprop.0 (drivers/gpu/drm/amd/amdgpu/amdgpuacpi.c:386 (discriminator 1)) amdgpu
It has been encountered on at least one system, so guard for it.
(cherry picked from commit c9b7c809b89f24e9372a4e7f02d64c950b07fdee)
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Compensating control
If a BIOS returns bad data to the ACPI ATIF method call, guard the caller in the Linux kernel to prevent the NULL pointer dereference (drm/amd: Guard against bad data for ATIF ACPI method).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50117?
CVE-2024-50117 has a high severity due to the potential NULL pointer dereference it causes.
How do I fix CVE-2024-50117?
To fix CVE-2024-50117, update your Linux kernel to the latest version that addresses this vulnerability.
What systems are affected by CVE-2024-50117?
CVE-2024-50117 affects multiple versions of the Linux kernel from 4.2 to 6.12-rc4.
What is the nature of CVE-2024-50117?
CVE-2024-50117 is a vulnerability in the Linux kernel related to handling bad data from the ATIF ACPI method.
Can CVE-2024-50117 be exploited remotely?
CVE-2024-50117 may be exploited if a BIOS provides malformed data, allowing local attackers to cause a crash.