CVE-2021-47108 drm/mediatek: hdmi: Perform NULL pointer check for mtk_hdmi_conf
A missing NULL pointer check in the Mediatek HDMI driver causes a kernel crash when an HDMI cable is plugged in on MT8173 devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-47108?
CVE-2021-47108 is a medium-severity vulnerability in Linux kernel, published on 4 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/mediatek: hdmi: Perform NULL pointer check for mtk_hdmi_conf
In commit 41ca9caaae0b ("drm/mediatek: hdmi: Add check for CEA modes only") a check for CEA modes was added to function mtk_hdmi_bridge_mode_valid() in order to address possible issues on MT8167; moreover, with commit c91026a938c2 ("drm/mediatek: hdmi: Add optional limit on maximal HDMI mode clock") another similar check was introduced.
Unfortunately though, at the time of writing, MT8173 does not provide any mtk_hdmi_conf structure and this is crashing the kernel with NULL pointer upon entering mtk_hdmi_bridge_mode_valid(), which happens as soon as a HDMI cable gets plugged in.
To fix this regression, add a NULL pointer check for hdmi->conf in the said function, restoring HDMI functionality and avoiding NULL pointer kernel panics.
Weakness: CWE-476
Which versions are affected by CVE-2021-47108?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2021-47108?
Apply the vendor's patch.
Is CVE-2021-47108 being exploited?
There is no known exploitation of CVE-2021-47108 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2021-47108, GHSA-48ww-vppq-9c8v, UBUNTU-CVE-2021-47108.