Cloudanix VulnDB

CVE-2024-43895

None

CVSS

—

EPSS

—

Published

Aug 26, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux graphics handling can crash the whole computer when certain advanced monitor setups are used with AMD video cards.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in drm_dp_atomic_find_time_slots during DSC parameter recomputation for MST links when no stream is present on the link, triggered in amdgpu_dm_atomic_check.

Why it matters to the business

Kernel crashes and system instability on Linux systems using AMD GPUs with multi-stream display setups and display stream compression, leading to downtime and potential loss of graphical sessions.

How an attack unfolds

An attacker with local access triggers atomic display state changes involving MST hubs and DSC on AMD hardware; the missing stream check allows dereference of a NULL pointer in the time slot calculation path, crashing the kernel.

How to fix it

Update the Linux kernel to a version containing commit 282f0a482ee61d5e863512f3c4fcec90216c20d9 or later; for Android kernels apply the equivalent fix dated 2023-03-05 or newer backports.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or is newer than the fixed stable releases; reproduce the atomic check path with MST+DSC configurations to confirm absence of the oops.

Typical attack path

  1. Obtain local user access on affected Linux system with AMD display hardware
  2. Configure or trigger display mode changes using MST topology and DSC encoding
  3. Invoke drm atomic check ioctl to force recompute of DSC parameters
  4. Hit the NULL dereference in drm_dp_atomic_find_time_slots when no stream exists on link

How to detect it

Inspect kernel logs for Oops messages containing drm_dp_atomic_find_time_slots and page_fault_oops during amdgpu_dm_atomic_check calls; correlate with processes performing display configuration changes.

  • drm_dp_atomic_find_time_slots+0x5e/0x260
  • compute_mst_dsc_configs_for_link
  • BUG: kernel NULL pointer dereference, address: 0000000000000008
  • RIP: drm_dp_atomic_find_time_slots

What your security team should do

  • Prioritize kernel upgrades on all AMD GPU systems using display compression and multi-stream transports
  • Monitor for kernel oops reports referencing drm_dp_atomic_find_time_slots
  • Restrict unprivileged access to graphics ioctls where feasible until patched

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Recompute DSC Params if no Stream on Link [why] Encounter NULL pointer dereference uner mst + dsc setup. BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 4 PID: 917 Comm: sway Not tainted 6.3.9-arch1-1 #1 124dc55df4f5272ccb409f39ef4872fc2b3376a2 Hardware name: LENOVO 20NKS01Y00/20NKS01Y00, BIOS R12ET61W(1.31 ) 07/28/2022 RIP: 0010:drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper] Code: 01 00 00 48 8b 85 60 05 00 00 48 63 80 88 00 00 00 3b 43 28 0f 8d 2e 01 00 00 48 8b 53 30 48 8d 04 80 48 8d 04 c2 48 8b 40 18 <48> 8> RSP: 0018:ffff960cc2df77d8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff8afb87e81280 RCX: 0000000000000224 RDX: ffff8afb9ee37c00 RSI: ffff8afb8da1a578 RDI: ffff8afb87e81280 RBP: ffff8afb83d67000 R08: 0000000000000001 R09: ffff8afb9652f850 R10: ffff960cc2df7908 R11: 0000000000000002 R12: 0000000000000000 R13: ffff8afb8d7688a0 R14: ffff8afb8da1a578 R15: 0000000000000224 FS: 00007f4dac35ce00(0000) GS:ffff8afe30b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000010ddc6000 CR4: 00000000003506e0 Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? plist_add+0xbe/0x100 ? exc_page_fault+0x7c/0x180 ? asm_exc_page_fault+0x26/0x30 ? drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026] ? drm_dp_atomic_find_time_slots+0x28/0x260 [drm_display_helper 0e67723696438d8e02b741593dd50d80b44c2026] compute_mst_dsc_configs_for_link+0x2ff/0xa40 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054] ? fill_plane_buffer_attributes+0x419/0x510 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054] compute_mst_dsc_configs_for_state+0x1e1/0x250 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054] amdgpu_dm_atomic_check+0xecd/0x1190 [amdgpu 62e600d2a75e9158e1cd0a243bdc8e6da040c054] drm_atomic_check_only+0x5c5/0xa40 drm_mode_atomic_ioctl+0x76e/0xbc0 [how] dsc recompute should be skipped if no mode change detected on the new request. If detected, keep checking whether the stream is already on current state or not. (cherry picked from commit 8151a6c13111b465dbabe07c19f572f7cbd16fef)

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 No fix
Debian:11 linux-6.1 0 6.1.119-1~deb11u1
Debian:12 linux 0 6.1.106-1
Debian:13 linux 0 6.10.6-1
Linux Kernel 5.16.0 6.1.105
Mageia:9 kernel 0 6.6.50-1.mga9
Mageia:9 kernel-linus 0 6.6.50-1.mga9
Mageia:9 kmod-virtualbox 0 7.0.20-53.mga9
Mageia:9 kmod-xtables-addons 0 3.24-61.mga9
SUSE:Linux Enterprise High Availability Extension 15 SP5 kernel-default 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise High Availability Extension 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-default 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-livepatch-SLE15-SP5-RT_Update_19 0 1-150500.11.3.2
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_19 0 1-150500.11.3.2
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_2 0 1-150600.1.3.2
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_4 0 1-150600.13.3.3
SUSE:Linux Enterprise Micro 5.5 kernel-default 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Micro 5.5 kernel-default-base 0 5.14.21-150500.55.80.2.150500.6.35.6
SUSE:Linux Enterprise Micro 5.5 kernel-rt 0 5.14.21-150500.13.67.3
SUSE:Linux Enterprise Micro 5.5 kernel-source-rt 0 5.14.21-150500.13.67.3
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-64kb 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-default 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-default-base 0 5.14.21-150500.55.80.2.150500.6.35.6
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-source 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-zfcpdump 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-64kb 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-default-base 0 6.4.0-150600.23.22.1.150600.12.8.3
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-source 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-zfcpdump 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-docs 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-obs-build 0 5.14.21-150500.55.80.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-source 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-syms 0 5.14.21-150500.55.80.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-docs 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-obs-build 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-source 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-syms 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Legacy 15 SP5 kernel-default 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Module for Legacy 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-azure 0 5.14.21-150500.33.66.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-source-azure 0 5.14.21-150500.33.66.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-syms-azure 0 5.14.21-150500.33.66.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-azure 0 6.4.0-150600.8.11.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-source-azure 0 6.4.0-150600.8.11.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-syms-azure 0 6.4.0-150600.8.11.1
SUSE:Linux Enterprise Workstation Extension 15 SP5 kernel-default 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Workstation Extension 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Real Time Module 15 SP5 kernel-rt 0 5.14.21-150500.13.67.3
SUSE:Real Time Module 15 SP5 kernel-rt_debug 0 5.14.21-150500.13.67.3
SUSE:Real Time Module 15 SP5 kernel-source-rt 0 5.14.21-150500.13.67.3
SUSE:Real Time Module 15 SP5 kernel-syms-rt 0 5.14.21-150500.13.67.1
SUSE:Real Time Module 15 SP6 kernel-rt 0 6.4.0-150600.10.8.3
SUSE:Real Time Module 15 SP6 kernel-rt_debug 0 6.4.0-150600.10.8.3
SUSE:Real Time Module 15 SP6 kernel-source-rt 0 6.4.0-150600.10.8.3
SUSE:Real Time Module 15 SP6 kernel-syms-rt 0 6.4.0-150600.10.8.1
Ubuntu:14.04:LTS linux 0 3.11.0-12.19
Ubuntu:14.04:LTS linux-aws 0 4.4.0-1002.2
Ubuntu:14.04:LTS linux-azure 0 4.15.0-1023.24~14.04.1
Ubuntu:14.04:LTS linux-lts-xenial 0 4.4.0-13.29~14.04.1
Ubuntu:16.04:LTS linux 0 4.4.0-2.16
Ubuntu:16.04:LTS linux-aws 0 4.4.0-1001.10
Ubuntu:16.04:LTS linux-aws-hwe 0 4.15.0-1030.31~16.04.1
Ubuntu:16.04:LTS linux-azure 0 4.11.0-1009.9
Ubuntu:16.04:LTS linux-gcp 0 4.10.0-1004.4
Ubuntu:16.04:LTS linux-hwe 0 4.8.0-39.42~16.04.1
Ubuntu:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:16.04:LTS linux-kvm 0 4.4.0-1004.9
Ubuntu:16.04:LTS linux-oracle 0 4.15.0-1007.9~16.04.1
Ubuntu:18.04:LTS linux 0 4.13.0-16.19
Ubuntu:18.04:LTS linux-aws 0 4.15.0-1001.1
Ubuntu:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:18.04:LTS linux-aws-5.4 0 5.4.0-1018.18~18.04.1
Ubuntu:18.04:LTS linux-azure 0 No fix
Ubuntu:18.04:LTS linux-azure-4.15 0 4.15.0-1082.92
Ubuntu:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure-5.4 0 5.4.0-1020.20~18.04.1
Ubuntu:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:18.04:LTS linux-gcp 0 No fix
Ubuntu:18.04:LTS linux-gcp-4.15 0 4.15.0-1071.81
Ubuntu:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:18.04:LTS linux-gcp-5.4 0 5.4.0-1019.19~18.04.2
Ubuntu:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:18.04:LTS linux-hwe 0 No fix
Ubuntu:18.04:LTS linux-hwe-5.4 0 5.4.0-37.41~18.04.1
Ubuntu:18.04:LTS linux-hwe-edge 0 5.0.0-15.16~18.04.1
Ubuntu:18.04:LTS linux-ibm-5.4 0 5.4.0-1010.11~18.04.2
Ubuntu:18.04:LTS linux-kvm 0 4.15.0-1002.2
Ubuntu:18.04:LTS linux-oem 0 No fix
Ubuntu:18.04:LTS linux-oracle 0 4.15.0-1007.9
Ubuntu:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.4 0 5.4.0-1019.19~18.04.1
Ubuntu:18.04:LTS linux-raspi-5.4 0 5.4.0-1013.13~18.04.1
Ubuntu:20.04:LTS linux 0 5.4.0-9.12
Ubuntu:20.04:LTS linux-aws 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 5.15.0-1014.18~20.04.1
Ubuntu:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure 0 5.4.0-1006.6
Ubuntu:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 5.15.0-1007.8~20.04.1
Ubuntu:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 No fix
Ubuntu:20.04:LTS linux-bluefield 0 5.4.0-1007.10
Ubuntu:20.04:LTS linux-gcp 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 5.15.0-1006.9~20.04.1
Ubuntu:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:20.04:LTS linux-gke 0 No fix
Ubuntu:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 No fix
Ubuntu:20.04:LTS linux-gkeop-5.15 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 5.4.0-1003.4
Ubuntu:20.04:LTS linux-ibm-5.15 0 5.15.0-1033.36~20.04.1
Ubuntu:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 5.15.0-1003.5~20.04.1
Ubuntu:20.04:LTS linux-iot 0 5.4.0-1001.3
Ubuntu:20.04:LTS linux-kvm 0 5.4.0-1004.4
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 5.15.0-1007.9~20.04.1
Ubuntu:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 5.4.0-1007.7
Ubuntu:20.04:LTS linux-raspi2 0 No fix
Ubuntu:20.04:LTS linux-riscv 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 5.15.0-1015.17~20.04.1
Ubuntu:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 5.4.0-1020.24
Ubuntu:22.04:LTS linux 0 5.13.0-19.19
Ubuntu:22.04:LTS linux-allwinner-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws 0 5.13.0-1005.6
Ubuntu:22.04:LTS linux-aws-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws-6.2 0 No fix
Ubuntu:22.04:LTS linux-aws-6.5 0 No fix
Ubuntu:22.04:LTS linux-aws-6.8 0 6.8.0-1020.22~22.04.1
Ubuntu:22.04:LTS linux-azure 0 5.13.0-1006.7
Ubuntu:22.04:LTS linux-azure-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-6.2 0 No fix
Ubuntu:22.04:LTS linux-azure-6.5 0 No fix
Ubuntu:22.04:LTS linux-azure-6.8 0 6.8.0-1020.23~22.04.1
Ubuntu:22.04:LTS linux-azure-fde 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 5.13.0-1005.6
Ubuntu:22.04:LTS linux-gcp-5.19 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.5 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.8 0 6.8.0-1019.21~22.04.1
Ubuntu:22.04:LTS linux-gke 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-gkeop 0 5.15.0-1001.2
Ubuntu:22.04:LTS linux-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.8 0 6.8.0-50.51~22.04.1
Ubuntu:22.04:LTS linux-ibm 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-intel-iot-realtime 0 No fix
Ubuntu:22.04:LTS linux-intel-iot-realtime 0 5.15.0-1021.26
Ubuntu:22.04:LTS linux-intel-iotg 0 5.15.0-1004.6
Ubuntu:22.04:LTS linux-kvm 0 5.13.0-1004.4
Ubuntu:22.04:LTS linux-lowlatency 0 5.15.0-22.22
Ubuntu:22.04:LTS linux-lowlatency-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.8 0 6.8.0-50.51.1~22.04.1
Ubuntu:22.04:LTS linux-nvidia 0 5.15.0-1005.5
Ubuntu:22.04:LTS linux-nvidia-6.2 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.5 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.8 0 6.8.0-1019.21~22.04.1
Ubuntu:22.04:LTS linux-oem-5.17 0 No fix
Ubuntu:22.04:LTS linux-oem-6.0 0 No fix
Ubuntu:22.04:LTS linux-oem-6.1 0 No fix
Ubuntu:22.04:LTS linux-oem-6.5 0 No fix
Ubuntu:22.04:LTS linux-oracle 0 5.13.0-1008.10
Ubuntu:22.04:LTS linux-oracle-6.5 0 No fix
Ubuntu:22.04:LTS linux-oracle-6.8 0 6.8.0-1017.18~22.04.1
Ubuntu:22.04:LTS linux-raspi 0 5.13.0-1008.9
Ubuntu:22.04:LTS linux-realtime 0 No fix
Ubuntu:22.04:LTS linux-riscv 0 No fix
Ubuntu:22.04:LTS linux-riscv-5.19 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.5 0 No fix

Related vulnerabilities