In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: kms: Clear the HVS FIFO commit pointer once done
Commit 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a commit") introduced a wait on the previous commit done on a given HVS FIFO.
However, we never cleared that pointer once done. Since drm_crtc_commit_put can free the drm_crtc_commit structure directly if we were the last user, this means that it can lead to a use-after free if we were to duplicate the state, and that stale pointer would even be copied to the new state.
Set the pointer to NULL once we're done with the wait so that we don't carry over a pointer to a free'd structure.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 24, 2024 |
| Suse | — | Upgrade kernel-source-vanillaUpgrade kernel-docsUpgrade kselftests-kmp-rtUpgrade gfs2-kmp-azureUpgrade kernel-default-baseUpgrade dlm-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-azure-optionalUpgrade kernel-rt_debug-develUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-azureUpgrade dtb-rockchipUpgrade kernel-64kb-extraUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-rtUpgrade gfs2-kmp-defaultUpgrade kernel-rt-optionalUpgrade kernel-defaultUpgrade dtb-qcomUpgrade kernel-default-base-rebuildUpgrade kernel-default-livepatch-develUpgrade kernel-obs-buildUpgrade ocfs2-kmp-defaultUpgrade kernel-docs-htmlUpgrade kernel-azure-vdsoUpgrade kernel-rtUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-source-rtUpgrade dtb-alteraUpgrade dlm-kmp-rtUpgrade dtb-allwinnerUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-extraUpgrade kernel-azure-develUpgrade kernel-azureUpgrade ocfs2-kmp-64kbUpgrade dtb-nvidiaUpgrade dtb-caviumUpgrade dtb-sprdUpgrade kernel-debug-vdsoUpgrade dtb-broadcomUpgrade kernel-64kb-optionalUpgrade kernel-rt-livepatchUpgrade dtb-renesasUpgrade kernel-rt_debugUpgrade ocfs2-kmp-rtUpgrade gfs2-kmp-64kbUpgrade kernel-64kb-develUpgrade dtb-apmUpgrade kernel-default-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-develUpgrade kernel-kvmsmallUpgrade cluster-md-kmp-azureUpgrade dtb-amazonUpgrade kernel-develUpgrade kernel-zfcpdumpUpgrade reiserfs-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-debug-develUpgrade dtb-exynosUpgrade dtb-amlogicUpgrade kernel-default-vdsoUpgrade kernel-azure-extraUpgrade kernel-debug-livepatch-develUpgrade gfs2-kmp-rtUpgrade dtb-marvellUpgrade dtb-armUpgrade dtb-freescaleUpgrade dtb-hisiliconUpgrade kernel-rt-livepatch-develUpgrade ocfs2-kmp-azureUpgrade kernel-syms-rtUpgrade kernel-symsUpgrade kernel-kvmsmall-develUpgrade kernel-devel-azureUpgrade kernel-default-livepatchUpgrade kernel-default-extraUpgrade dtb-mediatekUpgrade dtb-xilinxUpgrade dtb-appleUpgrade dtb-amdUpgrade kselftests-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade cluster-md-kmp-rtUpgrade kernel-debugUpgrade kernel-obs-qaUpgrade kernel-syms-azureUpgrade kernel-default-optionalUpgrade cluster-md-kmp-defaultUpgrade kernel-64kb-livepatch-develUpgrade dtb-socionextUpgrade dtb-lgUpgrade kernel-azure-livepatch-develUpgrade kernel-macrosUpgrade dlm-kmp-64kbUpgrade kernel-64kbUpgrade kselftests-kmp-defaultUpgrade kernel-devel-rtUpgrade dlm-kmp-azureUpgrade kernel-source | Aug 9, 2024 | May 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub