UBUNTU-CVE-2024-49989

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix double free issue during amdgpu module unload Flexible endpoints use DIGs from available inflexible endpoints, so only the encoders of inflexible links need to be freed. Otherwise, a double free issue may occ...

UBUNTU-CVE-2024-49906

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointer before try to access it why & how Change the order of the pipectx-planestate check to ensure that planestate is not null before accessing it...

UBUNTU-CVE-2024-49892

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Initialize getbytesperelement's default to 1 Variables, used as denominators and maybe not assigned to other values, should not be 0. bytesperelementy & bytesperelementc are initialized by getbytesperelement whic...

UBUNTU-CVE-2024-49909

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for function pointer in dcn32setoutputtransferfunc This commit adds a null check for the setoutputgamma function pointer in the dcn32setoutputtransferfunc function. Previously, setoutputgamma was...

UBUNTU-CVE-2024-49899

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Initialize denominators' default to 1 WHAT & HOW Variables used as denominators and maybe not assigned to other values, should not be 0. Change their default to 1 so they are never 0. This fixes 10 DIVIDEBYZERO...

UBUNTU-CVE-2024-49970

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Implement bounds check for stream encoder creation in DCN401 'streamencregs' array is an array of dcn10streamencregisters structures. The array is initialized with four elements, corresponding to the four calls t...

UBUNTU-CVE-2024-49897

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check phantomstream before it is used dcn32enablephantomstream can return null, so returned value must be checked before used. This fixes 1 NULLRETURNS issue reported by Coverity...

UBUNTU-CVE-2024-49898

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null-initialized variables WHAT & HOW drrtiming and subvppipe are initialized to null and they are not always assigned new values. It is necessary to check for null before dereferencing. This fixes 2...

UBUNTU-CVE-2024-49971

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Increase array size of dummyboolean WHY dml2coresharedmodesupport and dmlcoremodesupport access the third element of dummyboolean, i.e. hwdebug5 = &s-dummyboolean2, when dummyboolean has size of 2. Any assignment...

UBUNTU-CVE-2024-49972

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Deallocate DML memory if allocation fails Why When DC state create DML memory allocation fails, memory is not deallocated subsequently, resulting in uninitialized structure that is not NULL. How Deallocate memory...

UBUNTU-CVE-2024-49920

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointers before multiple uses WHAT & HOW Poniters, such as streamenc and dc-bwvbios, are null checked previously in the same function, so Coverity warns "implies that streamenc and dc-bwvbios might be...

UBUNTU-CVE-2024-49923

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Pass non-null to dcn20validateapplypipesplitflags WHAT & HOW "dcn20validateapplypipesplitflags" dereferences merge, and thus it cannot be a null pointer. Let's pass a valid pointer to avoid null dereference. This...

UBUNTU-CVE-2024-49893

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check streamstatus before it is used WHAT & HOW dcstategetstreamstatus can return null, and therefore null must be checked before streamstatus is used. This fixes 1 NULLRETURNS issue reported by Coverity...

CVE-2024-49989 drm/amd/display: fix double free issue during amdgpu module unload

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix double free issue during amdgpu module unload Flexible endpoints use DIGs from available inflexible endpoints, so only the encoders of inflexible links need to be freed. Otherwise, a double free issue may occ...

CVE-2024-49989 drm/amd/display: fix double free issue during amdgpu module unload

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix double free issue during amdgpu module unload Flexible endpoints use DIGs from available inflexible endpoints, so only the encoders of inflexible links need to be freed. Otherwise, a double free issue may occ...

CVE-2024-49972 drm/amd/display: Deallocate DML memory if allocation fails

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Deallocate DML memory if allocation fails Why When DC state create DML memory allocation fails, memory is not deallocated subsequently, resulting in uninitialized structure that is not NULL. How Deallocate memory...

CVE-2024-49972

CVE-2024-49972 affects the Linux kernel DRM-AMD display path. The issue arises when creating DML memory during DC state changes: if the DML memory allocation fails, previously allocated memory was not deallocated, leaving an uninitialized, non-NULL structure. The documented fix deallocates the me...

CVE-2024-49971 drm/amd/display: Increase array size of dummy_boolean

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Increase array size of dummyboolean WHY dml2coresharedmodesupport and dmlcoremodesupport access the third element of dummyboolean, i.e. hwdebug5 = &s-dummyboolean2, when dummyboolean has size of 2. Any assignment...

CVE-2024-49971 drm/amd/display: Increase array size of dummy_boolean

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Increase array size of dummyboolean WHY dml2coresharedmodesupport and dmlcoremodesupport access the third element of dummyboolean, i.e. hwdebug5 = &s-dummyboolean2, when dummyboolean has size of 2. Any assignment...

CVE-2024-49969 drm/amd/display: Fix index out of bounds in DCN30 color transformation

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in DCN30 color transformation This commit addresses a potential index out of bounds issue in the cm3helpertranslatecurvetohwformat function in the DCN30 color management module. The issue...