In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: kms: Clear the HVS FIFO commit pointer once done
Commit 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a commit") introduced a wait on the previous commit done on a given HVS FIFO.
However, we never cleared that pointer once done. Since drm_crtc_commit_put can free the drm_crtc_commit structure directly if we were the last user, this means that it can lead to a use-after free if we were to duplicate the state, and that stale pointer would even be copied to the new state.
Set the pointer to NULL once we're done with the wait so that we don't carry over a pointer to a free'd structure.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 24, 2024 |
| Suse | — | Upgrade kernel-docsUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade dtb-rockchipUpgrade kernel-source-vanillaUpgrade dlm-kmp-defaultUpgrade kernel-rt_debug-develUpgrade kselftests-kmp-rtUpgrade gfs2-kmp-azureUpgrade kernel-64kb-extraUpgrade dtb-nvidiaUpgrade reiserfs-kmp-azureUpgrade kernel-source-rtUpgrade kernel-kvmsmall-vdsoUpgrade dtb-caviumUpgrade dtb-sprdUpgrade kernel-debug-vdsoUpgrade kernel-default-baseUpgrade kernel-obs-buildUpgrade dlm-kmp-rtUpgrade dtb-broadcomUpgrade kernel-rt-extraUpgrade reiserfs-kmp-64kbUpgrade kernel-azureUpgrade reiserfs-kmp-rtUpgrade kernel-default-livepatch-develUpgrade kernel-rtUpgrade kernel-default-base-rebuildUpgrade dtb-alteraUpgrade kernel-azure-vdsoUpgrade dtb-qcomUpgrade kernel-rt-optionalUpgrade kernel-docs-htmlUpgrade kernel-azure-develUpgrade kernel-azure-optionalUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kernel-rt-vdsoUpgrade kernel-rt_debug-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade dtb-allwinnerUpgrade kernel-defaultUpgrade kernel-syms-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-default-optionalUpgrade gfs2-kmp-64kbUpgrade kernel-debugUpgrade kselftests-kmp-defaultUpgrade kernel-macrosUpgrade kernel-64kb-optionalUpgrade kernel-develUpgrade gfs2-kmp-rtUpgrade dtb-amlogicUpgrade kernel-rt_debugUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade kernel-obs-qaUpgrade kernel-64kb-livepatch-develUpgrade cluster-md-kmp-rtUpgrade dtb-lgUpgrade dtb-amazonUpgrade cluster-md-kmp-azureUpgrade kernel-default-develUpgrade kernel-rt-livepatchUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-develUpgrade kernel-kvmsmallUpgrade dtb-apmUpgrade kernel-sourceUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade kernel-syms-rtUpgrade kernel-kvmsmall-develUpgrade kernel-default-livepatchUpgrade dtb-renesasUpgrade dtb-hisiliconUpgrade dtb-xilinxUpgrade dlm-kmp-azureUpgrade kernel-debug-develUpgrade dtb-marvellUpgrade dtb-freescaleUpgrade dtb-exynosUpgrade kernel-source-azureUpgrade kernel-default-extraUpgrade dtb-mediatekUpgrade kernel-symsUpgrade kernel-default-vdsoUpgrade kernel-devel-azureUpgrade kernel-debug-livepatch-develUpgrade dtb-armUpgrade kselftests-kmp-64kbUpgrade dtb-amdUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade dtb-socionextUpgrade kernel-azure-livepatch-develUpgrade kernel-64kbUpgrade dtb-appleUpgrade kernel-devel-rtUpgrade kernel-64kb-develUpgrade kernel-azure-extra | Aug 9, 2024 | May 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub