In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: kms: Clear the HVS FIFO commit pointer once done
Commit 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a commit") introduced a wait on the previous commit done on a given HVS FIFO.
However, we never cleared that pointer once done. Since drm_crtc_commit_put can free the drm_crtc_commit structure directly if we were the last user, this means that it can lead to a use-after free if we were to duplicate the state, and that stale pointer would even be copied to the new state.
Set the pointer to NULL once we're done with the wait so that we don't carry over a pointer to a free'd structure.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 24, 2024 |
| Suse | — | Upgrade dlm-kmp-azureUpgrade dtb-xilinxUpgrade dtb-lgUpgrade kernel-default-develUpgrade cluster-md-kmp-defaultUpgrade dtb-apmUpgrade kernel-zfcpdumpUpgrade kernel-debug-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-obs-qaUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-rt-livepatchUpgrade kernel-default-optionalUpgrade cluster-md-kmp-rtUpgrade kernel-syms-azureUpgrade kernel-azure-extraUpgrade kernel-default-vdsoUpgrade dtb-amlogicUpgrade dtb-exynosUpgrade dtb-mediatekUpgrade ocfs2-kmp-azureUpgrade dtb-hisiliconUpgrade gfs2-kmp-64kbUpgrade gfs2-kmp-rtUpgrade kselftests-kmp-64kbUpgrade kernel-symsUpgrade kernel-syms-rtUpgrade kernel-default-livepatchUpgrade kernel-debug-livepatch-develUpgrade dtb-armUpgrade kernel-rt-livepatch-develUpgrade kernel-sourceUpgrade dlm-kmp-64kbUpgrade dtb-amazonUpgrade dtb-marvellUpgrade kernel-devel-azureUpgrade kernel-default-extraUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-develUpgrade ocfs2-kmp-rtUpgrade kernel-debugUpgrade dtb-socionextUpgrade kernel-rt-develUpgrade kernel-rt_debugUpgrade kernel-kvmsmall-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-64kb-optionalUpgrade dtb-amdUpgrade kernel-devel-rtUpgrade kernel-kvmsmallUpgrade kernel-64kbUpgrade dtb-appleUpgrade kernel-azure-livepatch-develUpgrade dtb-freescaleUpgrade kernel-64kb-develUpgrade dtb-renesasUpgrade kernel-macrosUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade dtb-allwinnerUpgrade kernel-obs-buildUpgrade dtb-rockchipUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-alteraUpgrade kernel-default-base-rebuildUpgrade dtb-caviumUpgrade dtb-nvidiaUpgrade kernel-default-livepatch-develUpgrade kernel-azure-develUpgrade kernel-azure-vdsoUpgrade ocfs2-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-azureUpgrade dlm-kmp-defaultUpgrade kernel-docs-htmlUpgrade kernel-rtUpgrade kernel-source-vanillaUpgrade cluster-md-kmp-64kbUpgrade kernel-azure-optionalUpgrade kernel-rt-vdsoUpgrade kernel-docsUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-develUpgrade gfs2-kmp-azureUpgrade kernel-64kb-extraUpgrade gfs2-kmp-defaultUpgrade dtb-broadcomUpgrade kernel-debug-vdsoUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-extraUpgrade dtb-qcomUpgrade kernel-defaultUpgrade reiserfs-kmp-64kbUpgrade kernel-default-baseUpgrade dtb-sprdUpgrade kernel-kvmsmall-vdsoUpgrade dlm-kmp-rtUpgrade kernel-source-rtUpgrade kernel-rt-optionalUpgrade kernel-azure | Aug 9, 2024 | May 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub