Lucene search

K
osvGoogleOSV:CVE-2024-46698
HistorySep 13, 2024 - 6:15 a.m.

CVE-2024-46698

2024-09-1306:15:14
Google
osv.dev
linux kernel
vulnerability
video aperture
sysfb_disable
primary device
pci devices
vga class
null pointer dereference
device pointer
mutex

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.9

Confidence

Low

In the Linux kernel, the following vulnerability has been resolved:

video/aperture: optionally match the device in sysfb_disable()

In aperture_remove_conflicting_pci_devices(), we currently only
call sysfb_disable() on vga class devices. This leads to the
following problem when the pimary device is not VGA compatible:

  1. A PCI device with a non-VGA class is the boot display
  2. That device is probed first and it is not a VGA device so
    sysfb_disable() is not called, but the device resources
    are freed by aperture_detach_platform_device()
  3. Non-primary GPU has a VGA class and it ends up calling sysfb_disable()
  4. NULL pointer dereference via sysfb_disable() since the resources
    have already been freed by aperture_detach_platform_device() when
    it was called by the other device.

Fix this by passing a device pointer to sysfb_disable() and checking
the device to determine if we should execute it or not.

v2: Fix build when CONFIG_SCREEN_INFO is not set
v3: Move device check into the mutex
Drop primary variable in aperture_remove_conflicting_pci_devices()
Drop __init on pci sysfb_pci_dev_is_enabled()

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.9

Confidence

Low

Related for OSV:CVE-2024-46698