In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file could result in an abnormal null pointer access when the smc_rreg pointer is NULL. Below are the steps to reproduce this issue and the corresponding exception log:
1. Navigate to the directory: /sys/kernel/debug/dri/0 2. Execute command: cat amdgpu_regs_smc 3. Exception Log:: [4005007.702554] BUG: kernel NULL pointer dereference, address: 0000000000000000 [4005007.702562] #PF: supervisor instruction fetch in kernel mode [4005007.702567] #PF: error_code(0x0010) - not-present page [4005007.702570] PGD 0 P4D 0 [4005007.702576] Oops: 0010 [#1] SMP NOPTI [4005007.702581] CPU: 4 PID: 62563 Comm: cat Tainted: G OE 5.15.0-43-generic #46-Ubunt u [4005007.702590] RIP: 0010:0x0 [4005007.702598] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. [4005007.702600] RSP: 0018:ffffa82b46d27da0 EFLAGS: 00010206 [4005007.702605] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffa82b46d27e68 [4005007.702609] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9940656e0000 [4005007.702612] RBP: ffffa82b46d27dd8 R08: 0000000000000000 R09: ffff994060c07980 [4005007.702615] R10: 0000000000020000 R11: 0000000000000000 R12: 00007f5e06753000 [4005007.702618] R13: ffff9940656e0000 R14: ffffa82b46d27e68 R15: 00007f5e06753000 [4005007.702622] FS: 00007f5e0755b740(0000) GS:ffff99479d300000(0000) knlGS:0000000000000000 [4005007.702626] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [4005007.702629] CR2: ffffffffffffffd6 CR3: 00000003253fc000 CR4: 00000000003506e0 [4005007.702633] Call Trace: [4005007.702636] <TASK> [4005007.702640] amdgpu_debugfs_regs_smc_read+0xb0/0x120 [amdgpu] [4005007.703002] full_proxy_read+0x5c/0x80 [4005007.703011] vfs_read+0x9f/0x1a0 [4005007.703019] ksys_read+0x67/0xe0 [4005007.703023] __x64_sys_read+0x19/0x20 [4005007.703028] do_syscall_64+0x5c/0xc0 [4005007.703034] ? do_user_addr_fault+0x1e3/0x670 [4005007.703040] ? exit_to_user_mode_prepare+0x37/0xb0 [4005007.703047] ? irqentry_exit_to_user_mode+0x9/0x20 [4005007.703052] ? irqentry_exit+0x19/0x30 [4005007.703057] ? exc_page_fault+0x89/0x160 [4005007.703062] ? asm_exc_page_fault+0x8/0x30 [4005007.703068] entry_SYSCALL_64_after_hwframe+0x44/0xae [4005007.703075] RIP: 0033:0x7f5e07672992 [4005007.703079] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 e c 28 48 89 54 24 [4005007.703083] RSP: 002b:00007ffe03097898 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [4005007.703088] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5e07672992 [4005007.703091] RDX: 0000000000020000 RSI: 00007f5e06753000 RDI: 0000000000000003 [4005007.703094] RBP: 00007f5e06753000 R08: 00007f5e06752010 R09: 00007f5e06752010 [4005007.703096] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000022000 [4005007.703099] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 [4005007.703105] </TASK> [4005007.703107] Modules linked in: nf_tables libcrc32c nfnetlink algif_hash af_alg binfmt_misc nls_ iso8859_1 ipmi_ssif ast intel_rapl_msr intel_rapl_common drm_vram_helper drm_ttm_helper amd64_edac t tm edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl sch_fq_codel ipmi_devintf ipm i_msghandler msr parport_pc ppdev lp parport mtd pstore_blk efi_pstore ramoops pstore_zone reed_solo mon ip_tables x_tables autofs4 ib_uverbs ib_core amdgpu(OE) amddrm_ttm_helper(OE) amdttm(OE) iommu_v 2 amd_sched(OE) amdkcl(OE) drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec rc_core drm igb ahci xhci_pci libahci i2c_piix4 i2c_algo_bit xhci_pci_renesas dca [4005007.703184] CR2: 0000000000000000 [4005007.703188] ---[ en ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-docUpgrade kernel-cross-headersUpgrade kernel-debug-develUpgrade python3-perfUpgrade kernel-rt-debug-develUpgrade kernel-develUpgrade kernelUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-rt-coreUpgrade kernel-tools-libs-develUpgrade perfUpgrade kernel-rt-develUpgrade kernel-debug-modules-extraUpgrade kernel-headersUpgrade kernel-rt-debugUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-rtUpgrade kernel-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-toolsUpgrade kernel-rt-kvmUpgrade kernel-rt-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdump-modulesUpgrade bpftoolUpgrade kernel-coreUpgrade kernel-debug-coreUpgrade kernel-zfcpdumpUpgrade kernel-debug-modulesUpgrade kernel-tools-libs | Sep 26, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Sep 25, 2024 | May 21, 2024 |
| Rocky_linux | — | Upgrade kernel-debug-modulesUpgrade python3-perf-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rtUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernelUpgrade kernel-cross-headersUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-develUpgrade python3-perfUpgrade kernel-rt-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-rt-debugUpgrade kernel-rt-kvmUpgrade kernel-toolsUpgrade kernel-develUpgrade kernel-tools-libsUpgrade kernel-debuginfoUpgrade kernel-debug-develUpgrade kernel-headersUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-rt-coreUpgrade kernel-coreUpgrade perfUpgrade kernel-debug-coreUpgrade bpftool-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-debugUpgrade perf-debuginfoUpgrade kernel-modulesUpgrade kernel-rt-debug-develUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-kvmUpgrade kernel-modules-extra | Oct 2, 2024 | May 21, 2024 |
| Suse | — | Upgrade reiserfs-kmp-azureUpgrade gfs2-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-kvmsmallUpgrade kernel-azure-optionalUpgrade kernel-devel-azureUpgrade kernel-zfcpdumpUpgrade dtb-xilinxUpgrade kselftests-kmp-64kbUpgrade kernel-source-azureUpgrade dtb-qcomUpgrade kernel-64kb-optionalUpgrade kernel-64kb-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-develUpgrade dtb-sprdUpgrade dtb-renesasUpgrade reiserfs-kmp-rtUpgrade kernel-docs-htmlUpgrade reiserfs-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-amdUpgrade kernel-debug-develUpgrade dtb-freescaleUpgrade kernel-azureUpgrade dtb-marvellUpgrade cluster-md-kmp-defaultUpgrade kernel-rt_debugUpgrade kernel-azure-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-amazonUpgrade kernel-rt_debug-vdsoUpgrade dlm-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-extraUpgrade kernel-64kbUpgrade kernel-default-livepatchUpgrade cluster-md-kmp-64kbUpgrade gfs2-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-debugUpgrade kernel-64kb-extraUpgrade kernel-symsUpgrade kernel-rt-livepatch-develUpgrade gfs2-kmp-defaultUpgrade dtb-broadcomUpgrade dtb-socionextUpgrade dtb-nvidiaUpgrade reiserfs-kmp-64kbUpgrade kernel-default-baseUpgrade kernel-azure-baseUpgrade dtb-hisiliconUpgrade kernel-defaultUpgrade dlm-kmp-azureUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-docsUpgrade dlm-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-default-develUpgrade dtb-appleUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-source-rtUpgrade kernel-default-manUpgrade kernel-default-livepatch-develUpgrade dtb-allwinnerUpgrade dtb-lgUpgrade dtb-armUpgrade cluster-md-kmp-azureUpgrade dlm-kmp-64kbUpgrade kernel-develUpgrade kernel-debug-vdsoUpgrade kernel-devel-rtUpgrade dtb-alteraUpgrade kernel-sourceUpgrade kernel-obs-build | Jun 13, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-intel-iotgUpgrade linux-gkeUpgrade linux-lowlatency-hwe-5.15Upgrade linux-lowlatencyUpgrade linux-awsUpgrade linux-ibm-5.15Upgrade linux-azure-fdeUpgrade linux-nvidia-tegra-5.15Upgrade linux-bluefieldUpgrade linux-ibm-5.4Upgrade linux-aws-5.4Upgrade linux-nvidia-tegraUpgrade linux-riscv-5.15Upgrade linux-fipsUpgrade linux-raspi-5.4Upgrade linux-oracle-5.4Upgrade linux-raspiUpgrade linux-aws-5.15Upgrade linuxUpgrade linux-oracle-5.15Upgrade linux-hwe-5.15Upgrade linux-gcpUpgrade linux-azure-5.4Upgrade linux-ibmUpgrade linux-azureUpgrade linux-nvidia-tegra-igxUpgrade linux-gcp-5.15Upgrade linux-azure-5.15Upgrade linux-nvidia-6.5Upgrade linux-realtimeUpgrade linux-oracleUpgrade linux-nvidiaUpgrade linux-xilinx-zynqmpUpgrade linux-kvmUpgrade linux-aws-fipsUpgrade linux-intel-iotg-5.15Upgrade linux-gcp-fipsUpgrade linux-intel-iot-realtimeUpgrade linux-azure-fipsUpgrade linux-gkeop-5.15Upgrade linux-gcp-5.4Upgrade linux-iotUpgrade linux-gkeopUpgrade linux-hwe-5.4 | Nov 19, 2024 | May 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub