SB2024071351 - NULL pointer dereference in Linux kernel display amdgpu_dm driver

Description

This security bulletin contains information about 1 security vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2024-39498)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nv50_msto_cleanup() function in drivers/gpu/drm/nouveau/dispnv50/disp.c, within the intel_mst_enable_dp() function in drivers/gpu/drm/i915/display/intel_dp_mst.c, within the EXPORT_SYMBOL() function in drivers/gpu/drm/display/drm_dp_mst_topology.c, within the dm_helpers_dp_mst_send_payload_allocation() function in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c. A local user can perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/8e21de5f99b2368a5155037ce0aae8aaba3f5241
• https://git.kernel.org/stable/c/5a507b7d2be15fddb95bf8dee01110b723e2bcd9
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10