CVE-2024-56778

What it actually does

Failure to check the return value of drm_atomic_get_crtc_state() allows an error pointer to be dereferenced in sti_hqvdp_atomic_check, resulting in potential invalid memory access.

Why it matters to the business

Systems may experience crashes or memory corruption that disrupts graphics operations and requires restarts or patches on affected Linux distributions.

How an attack unfolds

An attacker triggers the atomic check path in the STI HQVDP driver, causing the unchecked error pointer from drm_atomic_get_crtc_state() to be used and leading to memory corruption or denial of service.

How to fix it

Update chromium-browser on Ubuntu 14.04 LTS to version 53.0.2785.143-0ubuntu0.14.04.1.1142 or later to resolve the unchecked pointer dereference.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the listed fixed version and verify that the kernel source no longer contains the unchecked call path in sti_hqvdp_atomic_check.

Typical attack path

1. Identify a system using the STI DRM driver with HQVDP support
2. Craft inputs that cause drm_atomic_get_crtc_state() to return an error pointer
3. Trigger sti_hqvdp_atomic_check without validation
4. Dereference the error pointer to induce memory corruption or crash

How to detect it

Review kernel logs for oops messages mentioning sti_hqvdp_atomic_check or drm_atomic_get_crtc_state and inspect for unexpected process terminations after graphics operations.

What your security team should do

• Apply the listed package update immediately on all affected Ubuntu 14.04 systems
• Audit graphics driver usage for legacy STI hardware
• Monitor for kernel oops or panic logs related to drm_atomic