CVE-2024-49905
Severity CVSS v4.0:
Pending analysis
Type:
CWE-476
NULL Pointer Dereference
Publication date:
21/10/2024
Last modified:
03/11/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
drm/amd/display: Add null check for &#39;afb&#39; in amdgpu_dm_plane_handle_cursor_update (v2)<br />
<br />
This commit adds a null check for the &#39;afb&#39; variable in the<br />
amdgpu_dm_plane_handle_cursor_update function. Previously, &#39;afb&#39; was<br />
assumed to be null, but was used later in the code without a null check.<br />
This could potentially lead to a null pointer dereference.<br />
<br />
Changes since v1:<br />
- Moved the null check for &#39;afb&#39; to the line where &#39;afb&#39; is used. (Alex)<br />
<br />
Fixes the below:<br />
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:1298 amdgpu_dm_plane_handle_cursor_update() error: we previously assumed &#39;afb&#39; could be null (see line 1252)
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.1.113 (excluding) | |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.2 (including) | 6.6.55 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7 (including) | 6.10.14 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.11 (including) | 6.11.3 (excluding) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://git.kernel.org/stable/c/75839e2365b666ff4e1b9047e442cab138eac4f6
- https://git.kernel.org/stable/c/9132882eaae4d21d2fc5843b3308379a481ebdf0
- https://git.kernel.org/stable/c/bd0e24e5e608ccb9fdda300bb974496d6d8cf57d
- https://git.kernel.org/stable/c/cd9e9e0852d501f169aa3bb34e4b413d2eb48c37
- https://git.kernel.org/stable/c/e4e26cbe34d7c1c1db5fb7b3101573c29866439f
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html



