CVE-2024-53056 drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()
A NULL pointer dereference in the Linux kernel's Mediatek DRM driver can cause a system crash during cleanup if mailbox channel initialization fails.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53056?
CVE-2024-53056 is a medium-severity vulnerability in Linux kernel, published on 19 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()
In mtk_crtc_create(), if the call to mbox_request_channel() fails then we set the "mtk_crtc->cmdq_client.chan" pointer to NULL. In that situation, we do not call cmdq_pkt_create().
During the cleanup, we need to check if the "mtk_crtc->cmdq_client.chan" is NULL first before calling cmdq_pkt_destroy(). Calling cmdq_pkt_destroy() is unnecessary if we didn't call cmdq_pkt_create() and it will result in a NULL pointer dereference.
Weakness: CWE-476
Which versions are affected by CVE-2024-53056?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-53056?
Apply the vendor's patch.
Is CVE-2024-53056 being exploited?
There is no known exploitation of CVE-2024-53056 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-53852, BELL-CVE-2024-53056, DEBIAN-CVE-2024-53056, GHSA-5ggj-xwvc-9x57, ROOT-OS-DEBIAN-12-CVE-2024-53056, ROOT-OS-UBUNTU-2204-CVE-2024-53056 and 2 more.