In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: kms: Clear the HVS FIFO commit pointer once done
Commit 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a commit") introduced a wait on the previous commit done on a given HVS FIFO.
However, we never cleared that pointer once done. Since drm_crtc_commit_put can free the drm_crtc_commit structure directly if we were the last user, this means that it can lead to a use-after free if we were to duplicate the state, and that stale pointer would even be copied to the new state.
Set the pointer to NULL once we're done with the wait so that we don't carry over a pointer to a free'd structure.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 24, 2024 |
| Suse | — | Upgrade kernel-kvmsmallUpgrade kernel-rt-livepatchUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-develUpgrade dtb-xilinxUpgrade dtb-amdUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-64kbUpgrade dlm-kmp-azureUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-develUpgrade dtb-apmUpgrade kernel-debug-develUpgrade dtb-mediatekUpgrade kernel-default-extraUpgrade kernel-source-azureUpgrade kernel-azure-extraUpgrade dlm-kmp-64kbUpgrade dtb-amlogicUpgrade dtb-amazonUpgrade dtb-exynosUpgrade dtb-socionextUpgrade kernel-default-vdsoUpgrade kernel-symsUpgrade kernel-debug-livepatch-develUpgrade kselftests-kmp-defaultUpgrade kernel-64kb-optionalUpgrade kernel-64kb-develUpgrade kernel-devel-rtUpgrade kernel-sourceUpgrade kernel-default-optionalUpgrade kernel-debugUpgrade ocfs2-kmp-rtUpgrade dtb-armUpgrade ocfs2-kmp-azureUpgrade dtb-freescaleUpgrade dtb-renesasUpgrade kernel-rt_debugUpgrade gfs2-kmp-rtUpgrade dtb-hisiliconUpgrade kernel-azure-livepatch-develUpgrade kernel-default-livepatchUpgrade kernel-syms-rtUpgrade dtb-marvellUpgrade kernel-devel-azureUpgrade kernel-macrosUpgrade kernel-kvmsmall-develUpgrade kernel-rt-livepatch-develUpgrade dtb-appleUpgrade gfs2-kmp-64kbUpgrade kernel-64kbUpgrade kernel-zfcpdumpUpgrade kernel-obs-qaUpgrade kernel-develUpgrade kernel-syms-azureUpgrade reiserfs-kmp-defaultUpgrade cluster-md-kmp-defaultUpgrade dtb-lgUpgrade kernel-64kb-livepatch-develUpgrade cluster-md-kmp-rtUpgrade kernel-default-livepatch-develUpgrade kernel-obs-buildUpgrade kernel-rt-vdsoUpgrade kernel-docsUpgrade kernel-64kb-extraUpgrade kernel-azure-develUpgrade kernel-rt_debug-livepatch-develUpgrade ocfs2-kmp-defaultUpgrade kernel-azure-vdsoUpgrade dtb-rockchipUpgrade gfs2-kmp-defaultUpgrade kernel-rt-optionalUpgrade kernel-default-baseUpgrade dtb-qcomUpgrade dtb-sprdUpgrade dlm-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-extraUpgrade dtb-allwinnerUpgrade dtb-alteraUpgrade dtb-nvidiaUpgrade kernel-rtUpgrade kernel-source-rtUpgrade kernel-azureUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-azureUpgrade kernel-source-vanillaUpgrade kernel-azure-optionalUpgrade kselftests-kmp-rtUpgrade kselftests-kmp-azureUpgrade kernel-rt_debug-develUpgrade dlm-kmp-defaultUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade kernel-docs-htmlUpgrade kernel-default-base-rebuildUpgrade reiserfs-kmp-64kbUpgrade kernel-defaultUpgrade dtb-caviumUpgrade kernel-debug-vdsoUpgrade dtb-broadcomUpgrade reiserfs-kmp-rt | Aug 9, 2024 | May 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub