In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file could result in an abnormal null pointer access when the smc_rreg pointer is NULL. Below are the steps to reproduce this issue and the corresponding exception log:
1. Navigate to the directory: /sys/kernel/debug/dri/0 2. Execute command: cat amdgpu_regs_smc 3. Exception Log:: [4005007.702554] BUG: kernel NULL pointer dereference, address: 0000000000000000 [4005007.702562] #PF: supervisor instruction fetch in kernel mode [4005007.702567] #PF: error_code(0x0010) - not-present page [4005007.702570] PGD 0 P4D 0 [4005007.702576] Oops: 0010 [#1] SMP NOPTI [4005007.702581] CPU: 4 PID: 62563 Comm: cat Tainted: G OE 5.15.0-43-generic #46-Ubunt u [4005007.702590] RIP: 0010:0x0 [4005007.702598] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. [4005007.702600] RSP: 0018:ffffa82b46d27da0 EFLAGS: 00010206 [4005007.702605] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffa82b46d27e68 [4005007.702609] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9940656e0000 [4005007.702612] RBP: ffffa82b46d27dd8 R08: 0000000000000000 R09: ffff994060c07980 [4005007.702615] R10: 0000000000020000 R11: 0000000000000000 R12: 00007f5e06753000 [4005007.702618] R13: ffff9940656e0000 R14: ffffa82b46d27e68 R15: 00007f5e06753000 [4005007.702622] FS: 00007f5e0755b740(0000) GS:ffff99479d300000(0000) knlGS:0000000000000000 [4005007.702626] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [4005007.702629] CR2: ffffffffffffffd6 CR3: 00000003253fc000 CR4: 00000000003506e0 [4005007.702633] Call Trace: [4005007.702636] <TASK> [4005007.702640] amdgpu_debugfs_regs_smc_read+0xb0/0x120 [amdgpu] [4005007.703002] full_proxy_read+0x5c/0x80 [4005007.703011] vfs_read+0x9f/0x1a0 [4005007.703019] ksys_read+0x67/0xe0 [4005007.703023] __x64_sys_read+0x19/0x20 [4005007.703028] do_syscall_64+0x5c/0xc0 [4005007.703034] ? do_user_addr_fault+0x1e3/0x670 [4005007.703040] ? exit_to_user_mode_prepare+0x37/0xb0 [4005007.703047] ? irqentry_exit_to_user_mode+0x9/0x20 [4005007.703052] ? irqentry_exit+0x19/0x30 [4005007.703057] ? exc_page_fault+0x89/0x160 [4005007.703062] ? asm_exc_page_fault+0x8/0x30 [4005007.703068] entry_SYSCALL_64_after_hwframe+0x44/0xae [4005007.703075] RIP: 0033:0x7f5e07672992 [4005007.703079] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 e c 28 48 89 54 24 [4005007.703083] RSP: 002b:00007ffe03097898 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [4005007.703088] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5e07672992 [4005007.703091] RDX: 0000000000020000 RSI: 00007f5e06753000 RDI: 0000000000000003 [4005007.703094] RBP: 00007f5e06753000 R08: 00007f5e06752010 R09: 00007f5e06752010 [4005007.703096] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000022000 [4005007.703099] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 [4005007.703105] </TASK> [4005007.703107] Modules linked in: nf_tables libcrc32c nfnetlink algif_hash af_alg binfmt_misc nls_ iso8859_1 ipmi_ssif ast intel_rapl_msr intel_rapl_common drm_vram_helper drm_ttm_helper amd64_edac t tm edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl sch_fq_codel ipmi_devintf ipm i_msghandler msr parport_pc ppdev lp parport mtd pstore_blk efi_pstore ramoops pstore_zone reed_solo mon ip_tables x_tables autofs4 ib_uverbs ib_core amdgpu(OE) amddrm_ttm_helper(OE) amdttm(OE) iommu_v 2 amd_sched(OE) amdkcl(OE) drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec rc_core drm igb ahci xhci_pci libahci i2c_piix4 i2c_algo_bit xhci_pci_renesas dca [4005007.703184] CR2: 0000000000000000 [4005007.703188] ---[ en ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-develUpgrade kernel-rt-modulesUpgrade kernel-rt-debugUpgrade bpftoolUpgrade kernel-zfcpdump-modulesUpgrade kernel-tools-libsUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-coreUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-rt-kvmUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-rt-debug-kvmUpgrade kernel-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-headersUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade kernel-rt-debug-coreUpgrade kernel-modulesUpgrade kernel-rtUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-docUpgrade kernel-rt-coreUpgrade python3-perfUpgrade kernel-rt-debug-develUpgrade kernelUpgrade kernel-develUpgrade kernel-cross-headersUpgrade perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-debug-develUpgrade kernel-rt-modules-extra | Sep 26, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Sep 25, 2024 | May 21, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-debugUpgrade bpftool-debuginfoUpgrade perfUpgrade kernel-rt-debug-kvmUpgrade kernel-debuginfoUpgrade kernel-coreUpgrade kernel-debug-coreUpgrade kernel-rt-coreUpgrade kernel-rt-modulesUpgrade kernel-modules-extraUpgrade kernel-headersUpgrade kernel-debug-develUpgrade kernel-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade perf-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-modulesUpgrade python3-perf-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-rt-develUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-rtUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-debug-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-cross-headersUpgrade kernel-toolsUpgrade kernel-rt-kvmUpgrade kernel-rt-debugUpgrade bpftoolUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-devel | Oct 2, 2024 | May 21, 2024 |
| Suse | — | Upgrade cluster-md-kmp-defaultUpgrade kernel-debug-develUpgrade kernel-azure-vdsoUpgrade dtb-marvellUpgrade gfs2-kmp-64kbUpgrade dtb-freescaleUpgrade kernel-azureUpgrade kselftests-kmp-rtUpgrade kernel-rt_debugUpgrade dtb-socionextUpgrade ocfs2-kmp-64kbUpgrade dtb-appleUpgrade kernel-default-develUpgrade kernel-default-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade kernel-default-manUpgrade kernel-source-rtUpgrade kernel-syms-rtUpgrade kernel-default-baseUpgrade kernel-azure-develUpgrade cluster-md-kmp-azureUpgrade dtb-caviumUpgrade kselftests-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade kernel-kvmsmall-develUpgrade kernel-64kb-develUpgrade kernel-default-extraUpgrade kernel-macrosUpgrade kernel-rtUpgrade dtb-rockchipUpgrade kernel-rt_debug-develUpgrade kernel-kvmsmall-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade dtb-amazonUpgrade kernel-obs-qaUpgrade kernel-default-base-rebuildUpgrade gfs2-kmp-azureUpgrade kernel-devel-rtUpgrade kernel-obs-buildUpgrade kernel-default-vdsoUpgrade kernel-rt-develUpgrade dtb-qcomUpgrade kernel-source-azureUpgrade dtb-exynosUpgrade ocfs2-kmp-rtUpgrade kernel-debug-vdsoUpgrade dtb-alteraUpgrade dtb-amlogicUpgrade kernel-devel-azureUpgrade kernel-syms-azureUpgrade dtb-mediatekUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmallUpgrade kernel-azure-optionalUpgrade gfs2-kmp-rtUpgrade dtb-xilinxUpgrade kernel-source-vanillaUpgrade cluster-md-kmp-rtUpgrade dtb-armUpgrade kernel-rt-livepatchUpgrade dtb-lgUpgrade dlm-kmp-64kbUpgrade kernel-rt-extraUpgrade dtb-apmUpgrade kernel-default-optionalUpgrade dtb-allwinnerUpgrade kernel-develUpgrade kernel-sourceUpgrade dtb-broadcomUpgrade dtb-nvidiaUpgrade kernel-azure-baseUpgrade dtb-renesasUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-amdUpgrade reiserfs-kmp-defaultUpgrade kernel-defaultUpgrade kernel-docsUpgrade dtb-sprdUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-azureUpgrade kernel-symsUpgrade gfs2-kmp-defaultUpgrade dtb-hisiliconUpgrade kselftests-kmp-azureUpgrade dlm-kmp-azureUpgrade kernel-rt-vdsoUpgrade kernel-rt-optionalUpgrade kernel-debugUpgrade kernel-64kb-extraUpgrade kernel-rt-livepatch-devel | Jun 13, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-nvidia-tegraUpgrade linux-nvidia-tegra-5.15Upgrade linux-ibm-5.4Upgrade linux-oracle-5.4Upgrade linux-raspi-5.4Upgrade linux-aws-5.4Upgrade linux-lowlatencyUpgrade linux-lowlatency-hwe-5.15Upgrade linux-fipsUpgrade linux-azure-fdeUpgrade linux-ibm-5.15Upgrade linux-raspiUpgrade linux-riscv-5.15Upgrade linuxUpgrade linux-awsUpgrade linux-gkeUpgrade linux-intel-iotgUpgrade linux-oracle-5.15Upgrade linux-bluefieldUpgrade linux-aws-5.15Upgrade linux-ibmUpgrade linux-gcpUpgrade linux-azure-5.4Upgrade linux-realtimeUpgrade linux-hwe-5.15Upgrade linux-nvidiaUpgrade linux-intel-iot-realtimeUpgrade linux-kvmUpgrade linux-aws-fipsUpgrade linux-intel-iotg-5.15Upgrade linux-gcp-5.4Upgrade linux-oracleUpgrade linux-azure-5.15Upgrade linux-gkeop-5.15Upgrade linux-gcp-5.15Upgrade linux-nvidia-6.5Upgrade linux-xilinx-zynqmpUpgrade linux-iotUpgrade linux-gcp-fipsUpgrade linux-azureUpgrade linux-azure-fipsUpgrade linux-hwe-5.4Upgrade linux-gkeopUpgrade linux-nvidia-tegra-igx | Nov 19, 2024 | May 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub