NULL pointer dereference in Linux kernel dc dcn10 driver

1) NULL pointer dereference

EUVDB-ID: #VU90521

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27044

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dcn10_set_output_transfer_func() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 5.4 - 6.8.1

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:5.4:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.4.0:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.4.0:rc6:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.4.1:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.4.2:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.4.3:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.4.4:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.4.5:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.4.6:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:5.4.7:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/e019d87e02f1e539ae48b99187f253847744ca7a
https://git.kernel.org/stable/c/330caa061af53ea6d287d7c43d0703714e510e08
https://git.kernel.org/stable/c/6ac7c7a3a9ab57aba0fe78ecb922d2b20e16efeb
https://git.kernel.org/stable/c/29fde8895b2fcc33f44aea28c644ce2d9b62f9e0
https://git.kernel.org/stable/c/2d9fe7787af01188dc470a649bdbb842d6511fd7
https://git.kernel.org/stable/c/14613d52bc7fc180df6d2c65ba65fc921fc1dda7
https://git.kernel.org/stable/c/7874ab3105ca4657102fee1cc14b0af70883c484
https://git.kernel.org/stable/c/9ccfe80d022df7c595f1925afb31de2232900656
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.214
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.153
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.273
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.83
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.23
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7.11
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8.2

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.