CVE-2024-27040 drm/amd/display: Add 'replay' NULL check in 'edp_set_replay_allow_active()'
A missing null check in the AMD display driver allows a local attacker to trigger a kernel crash via null pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-27040?
CVE-2024-27040 is a medium-severity vulnerability in Linux kernel, published on 1 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Add 'replay' NULL check in 'edp_set_replay_allow_active()'
In the first if statement, we're checking if 'replay' is NULL. But in the second if statement, we're not checking if 'replay' is NULL again before calling replay->funcs->replay_set_power_opt().
if (replay == NULL && force_static) return false;
...
if (link->replay_settings.replay_feature_enabled && replay->funcs->replay_set_power_opt) { replay->funcs->replay_set_power_opt(replay, *power_opts, panel_inst); link->replay_settings.replay_power_opt_active = *power_opts; }
If 'replay' is NULL, this will cause a null pointer dereference.
Fixes the below found by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_edp_panel_control.c:895 edp_set_replay_allow_active() error: we previously assumed 'replay' could be null (see line 887)
Weakness: CWE-476
Which versions are affected by CVE-2024-27040?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-27040?
Apply the vendor's patch.
Is CVE-2024-27040 being exploited?
There is no known exploitation of CVE-2024-27040 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-27040, DEBIAN-CVE-2024-27040, GHSA-973h-x7w2-jgpx, UBUNTU-CVE-2024-27040.