Cloudanix VulnDB

CVE-2024-43899

None

CVSS

—

EPSS

0.2%

Published

Aug 26, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in AMD graphics drivers for certain GPUs can make the computer crash or freeze when playing videos in fullscreen, and updating the system software fixes it.

Exploitation
Requires User Interaction
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Null pointer dereference in dcn20_get_dcc_compression_cap within the AMD display driver (dcn20_resource.c) when processing fullscreen video playback on DCN401 dGPUs, resulting in a kernel instruction fetch from address 0x0 and immediate oops.

Why it matters to the business

Workstation or server sessions using affected AMD GPUs become unresponsive or crash during media playback, causing lost work, interrupted services, and requiring reboots; stable low EPSS indicates limited widespread exploitation risk but still impacts users on unpatched kernels.

How an attack unfolds

An attacker or local user runs a video player such as mpv with hardware decoding enabled and triggers fullscreen mode, causing the display driver to call into uninitialized DCC compression capability structures and dereference a null pointer during atomic plane state updates.

How to fix it

Apply the upstream fix present in commit 6940c1d0c84a34d5a2038714c218238101a1db5b or later; update the Linux kernel to a stable branch containing this commit; Android devices should ensure they are running patched framework versions from December 2022 or newer that incorporate equivalent display handling safeguards.

How to confirm the fix worked

Confirm the presence of commit 6940c1d0c84a34d5a2038714c218238101a1db5b in the running kernel source; reproduce the mpv fullscreen playback scenario and verify absence of the NULL pointer oops; inspect dmesg for clean atomic check paths under amdgpu_dm_atomic_check.

Typical attack path

  1. Obtain local access to a system with a DCN401 dGPU and vulnerable amdgpu driver
  2. Launch a media player configured for VAAPI hardware decoding and GPU video output
  3. Initiate fullscreen playback to exercise plane attribute and DCC validation paths
  4. Trigger the null pointer dereference in dcn20_get_dcc_compression_cap leading to kernel panic

How to detect it

Review kernel logs for BUG: kernel NULL pointer dereference combined with the call trace containing dcn20_get_dcc_compression_cap, amdgpu_dm_plane_validate_dcc, and amdgpu_dm_atomic_check; correlate with processes invoking hardware video decoding such as mpv or gnome-shell.

What your security team should do

  • Prioritize kernel updates on all systems with AMD DCN401 or similar GPUs within standard patch windows
  • Monitor EPSS and KEV status for any future increase in exploit maturity
  • Restrict untrusted local users from hardware-accelerated video playback until patched
  • Include the fixed commit hash in internal kernel build validation pipelines

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix null pointer deref in dcn20_resource.c Fixes a hang thats triggered when MPV is run on a DCN401 dGPU: mpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all and then enabling fullscreen playback (double click on the video) The following calltrace will be seen: [ 181.843989] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 181.843997] #PF: supervisor instruction fetch in kernel mode [ 181.844003] #PF: error_code(0x0010) - not-present page [ 181.844009] PGD 0 P4D 0 [ 181.844020] Oops: 0010 [#1] PREEMPT SMP NOPTI [ 181.844028] CPU: 6 PID: 1892 Comm: gnome-shell Tainted: G W OE 6.5.0-41-generic #41~22.04.2-Ubuntu [ 181.844038] Hardware name: System manufacturer System Product Name/CROSSHAIR VI HERO, BIOS 6302 10/23/2018 [ 181.844044] RIP: 0010:0x0 [ 181.844079] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [ 181.844084] RSP: 0018:ffffb593c2b8f7b0 EFLAGS: 00010246 [ 181.844093] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000004 [ 181.844099] RDX: ffffb593c2b8f804 RSI: ffffb593c2b8f7e0 RDI: ffff9e3c8e758400 [ 181.844105] RBP: ffffb593c2b8f7b8 R08: ffffb593c2b8f9c8 R09: ffffb593c2b8f96c [ 181.844110] R10: 0000000000000000 R11: 0000000000000000 R12: ffffb593c2b8f9c8 [ 181.844115] R13: 0000000000000001 R14: ffff9e3c88000000 R15: 0000000000000005 [ 181.844121] FS: 00007c6e323bb5c0(0000) GS:ffff9e3f85f80000(0000) knlGS:0000000000000000 [ 181.844128] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 181.844134] CR2: ffffffffffffffd6 CR3: 0000000140fbe000 CR4: 00000000003506e0 [ 181.844141] Call Trace: [ 181.844146] <TASK> [ 181.844153] ? show_regs+0x6d/0x80 [ 181.844167] ? __die+0x24/0x80 [ 181.844179] ? page_fault_oops+0x99/0x1b0 [ 181.844192] ? do_user_addr_fault+0x31d/0x6b0 [ 181.844204] ? exc_page_fault+0x83/0x1b0 [ 181.844216] ? asm_exc_page_fault+0x27/0x30 [ 181.844237] dcn20_get_dcc_compression_cap+0x23/0x30 [amdgpu] [ 181.845115] amdgpu_dm_plane_validate_dcc.constprop.0+0xe5/0x180 [amdgpu] [ 181.845985] amdgpu_dm_plane_fill_plane_buffer_attributes+0x300/0x580 [amdgpu] [ 181.846848] fill_dc_plane_info_and_addr+0x258/0x350 [amdgpu] [ 181.847734] fill_dc_plane_attributes+0x162/0x350 [amdgpu] [ 181.848748] dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.849791] ? dm_update_plane_state.constprop.0+0x4e3/0x6b0 [amdgpu] [ 181.850840] amdgpu_dm_atomic_check+0xdfe/0x1760 [amdgpu]

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 No fix
Debian:12 linux 0 No fix
Debian:13 linux 0 6.10.6-1
Linux Kernel 4.15.0 6.10.5
Linux Kernel 4.15.0 6.6.120
SUSE:Linux Enterprise High Availability Extension 15 SP5 kernel-default 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise High Availability Extension 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-default 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-livepatch-SLE15-SP5-RT_Update_19 0 1-150500.11.3.2
SUSE:Linux Enterprise Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_19 0 1-150500.11.3.2
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_2 0 1-150600.1.3.2
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_4 0 1-150600.13.3.3
SUSE:Linux Enterprise Micro 5.5 kernel-default 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Micro 5.5 kernel-default-base 0 5.14.21-150500.55.80.2.150500.6.35.6
SUSE:Linux Enterprise Micro 5.5 kernel-rt 0 5.14.21-150500.13.67.3
SUSE:Linux Enterprise Micro 5.5 kernel-source-rt 0 5.14.21-150500.13.67.3
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-64kb 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-default 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-default-base 0 5.14.21-150500.55.80.2.150500.6.35.6
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-source 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Module for Basesystem 15 SP5 kernel-zfcpdump 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-64kb 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-default-base 0 6.4.0-150600.23.22.1.150600.12.8.3
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-source 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Basesystem 15 SP6 kernel-zfcpdump 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-docs 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-obs-build 0 5.14.21-150500.55.80.1
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-source 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Module for Development Tools 15 SP5 kernel-syms 0 5.14.21-150500.55.80.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-docs 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-obs-build 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-source 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Development Tools 15 SP6 kernel-syms 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Legacy 15 SP5 kernel-default 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Module for Legacy 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-azure 0 5.14.21-150500.33.66.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-source-azure 0 5.14.21-150500.33.66.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP5 kernel-syms-azure 0 5.14.21-150500.33.66.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-azure 0 6.4.0-150600.8.11.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-source-azure 0 6.4.0-150600.8.11.1
SUSE:Linux Enterprise Module for Public Cloud 15 SP6 kernel-syms-azure 0 6.4.0-150600.8.11.1
SUSE:Linux Enterprise Workstation Extension 15 SP5 kernel-default 0 5.14.21-150500.55.80.2
SUSE:Linux Enterprise Workstation Extension 15 SP6 kernel-default 0 6.4.0-150600.23.22.1
SUSE:Real Time Module 15 SP5 kernel-rt 0 5.14.21-150500.13.67.3
SUSE:Real Time Module 15 SP5 kernel-rt_debug 0 5.14.21-150500.13.67.3
SUSE:Real Time Module 15 SP5 kernel-source-rt 0 5.14.21-150500.13.67.3
SUSE:Real Time Module 15 SP5 kernel-syms-rt 0 5.14.21-150500.13.67.1
SUSE:Real Time Module 15 SP6 kernel-rt 0 6.4.0-150600.10.8.3
SUSE:Real Time Module 15 SP6 kernel-rt_debug 0 6.4.0-150600.10.8.3
SUSE:Real Time Module 15 SP6 kernel-source-rt 0 6.4.0-150600.10.8.3
SUSE:Real Time Module 15 SP6 kernel-syms-rt 0 6.4.0-150600.10.8.1
Ubuntu:14.04:LTS linux 0 3.11.0-12.19
Ubuntu:14.04:LTS linux-aws 0 4.4.0-1002.2
Ubuntu:14.04:LTS linux-azure 0 4.15.0-1023.24~14.04.1
Ubuntu:14.04:LTS linux-lts-xenial 0 4.4.0-13.29~14.04.1
Ubuntu:16.04:LTS linux 0 4.4.0-2.16
Ubuntu:16.04:LTS linux-aws 0 4.4.0-1001.10
Ubuntu:16.04:LTS linux-aws-hwe 0 4.15.0-1030.31~16.04.1
Ubuntu:16.04:LTS linux-azure 0 4.11.0-1009.9
Ubuntu:16.04:LTS linux-gcp 0 4.10.0-1004.4
Ubuntu:16.04:LTS linux-hwe 0 4.8.0-39.42~16.04.1
Ubuntu:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:16.04:LTS linux-kvm 0 4.4.0-1004.9
Ubuntu:16.04:LTS linux-oracle 0 4.15.0-1007.9~16.04.1
Ubuntu:18.04:LTS linux 0 4.13.0-16.19
Ubuntu:18.04:LTS linux-aws 0 4.15.0-1001.1
Ubuntu:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure 0 No fix
Ubuntu:18.04:LTS linux-azure-4.15 0 4.15.0-1082.92
Ubuntu:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:18.04:LTS linux-gcp 0 No fix
Ubuntu:18.04:LTS linux-gcp-4.15 0 4.15.0-1071.81
Ubuntu:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:18.04:LTS linux-hwe 0 No fix
Ubuntu:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-kvm 0 4.15.0-1002.2
Ubuntu:18.04:LTS linux-oem 0 No fix
Ubuntu:18.04:LTS linux-oracle 0 4.15.0-1007.9
Ubuntu:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:20.04:LTS linux 0 No fix
Ubuntu:20.04:LTS linux-aws 0 No fix
Ubuntu:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 No fix
Ubuntu:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure 0 No fix
Ubuntu:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 No fix
Ubuntu:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 No fix
Ubuntu:20.04:LTS linux-bluefield 0 No fix
Ubuntu:20.04:LTS linux-gcp 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:20.04:LTS linux-gke 0 No fix
Ubuntu:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 No fix
Ubuntu:20.04:LTS linux-gkeop-5.15 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 No fix
Ubuntu:20.04:LTS linux-ibm-5.15 0 No fix
Ubuntu:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 No fix
Ubuntu:20.04:LTS linux-iot 0 No fix
Ubuntu:20.04:LTS linux-kvm 0 No fix
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 No fix
Ubuntu:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 No fix
Ubuntu:20.04:LTS linux-raspi2 0 No fix
Ubuntu:20.04:LTS linux-riscv 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 No fix
Ubuntu:22.04:LTS linux 0 No fix
Ubuntu:22.04:LTS linux-allwinner-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws 0 No fix
Ubuntu:22.04:LTS linux-aws-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws-6.2 0 No fix
Ubuntu:22.04:LTS linux-aws-6.5 0 No fix
Ubuntu:22.04:LTS linux-aws-6.8 0 6.8.0-1020.22~22.04.1
Ubuntu:22.04:LTS linux-azure 0 No fix
Ubuntu:22.04:LTS linux-azure-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-6.2 0 No fix
Ubuntu:22.04:LTS linux-azure-6.5 0 No fix
Ubuntu:22.04:LTS linux-azure-6.8 0 6.8.0-1020.23~22.04.1
Ubuntu:22.04:LTS linux-azure-fde 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 No fix
Ubuntu:22.04:LTS linux-gcp-5.19 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.5 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.8 0 6.8.0-1019.21~22.04.1
Ubuntu:22.04:LTS linux-gke 0 No fix
Ubuntu:22.04:LTS linux-gkeop 0 No fix
Ubuntu:22.04:LTS linux-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.8 0 6.8.0-50.51~22.04.1
Ubuntu:22.04:LTS linux-ibm 0 No fix
Ubuntu:22.04:LTS linux-ibm-6.8 0 6.8.0-1017.17~22.04.1
Ubuntu:22.04:LTS linux-intel-iot-realtime 0 No fix
Ubuntu:22.04:LTS linux-intel-iotg 0 No fix
Ubuntu:22.04:LTS linux-kvm 0 No fix
Ubuntu:22.04:LTS linux-lowlatency 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.8 0 6.8.0-50.51.1~22.04.1
Ubuntu:22.04:LTS linux-nvidia 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.2 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.5 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.8 0 6.8.0-1019.21~22.04.1
Ubuntu:22.04:LTS linux-nvidia-tegra 0 No fix
Ubuntu:22.04:LTS linux-nvidia-tegra-igx 0 No fix
Ubuntu:22.04:LTS linux-oem-5.17 0 No fix
Ubuntu:22.04:LTS linux-oem-6.0 0 No fix
Ubuntu:22.04:LTS linux-oem-6.1 0 No fix
Ubuntu:22.04:LTS linux-oem-6.5 0 No fix
Ubuntu:22.04:LTS linux-oracle 0 No fix
Ubuntu:22.04:LTS linux-oracle-6.5 0 No fix
Ubuntu:22.04:LTS linux-oracle-6.8 0 6.8.0-1017.18~22.04.1
Ubuntu:22.04:LTS linux-raspi 0 No fix
Ubuntu:22.04:LTS linux-realtime 0 No fix
Ubuntu:22.04:LTS linux-riscv 0 No fix
Ubuntu:22.04:LTS linux-riscv-5.19 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.5 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.8 0 6.8.0-50.51.1~22.04.1
Ubuntu:22.04:LTS linux-starfive-5.19 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.2 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.5 0 No fix
Ubuntu:22.04:LTS linux-xilinx-zynqmp 0 No fix
Ubuntu:22.04:LTS:for:NVIDIA:BlueField linux-bluefield 0 No fix
Ubuntu:24.04:LTS linux 0 6.8.0-50.51
Ubuntu:24.04:LTS linux-aws 0 6.8.0-1020.22
Ubuntu:24.04:LTS linux-azure 0 6.8.0-1020.23

Related vulnerabilities