CVE-2024-26649 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix the null pointer when load rlc firmware If the RLC firmware is invalid because of wrong header size, the pointer to the rlc firmware is released in function amdgpu_ucode_request. There will be a null pointer error in subsequent use. So skip validation to fix it.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/8b5bacce2d13dbe648f0bfd3f738ecce8db4978c
https://git.kernel.org/stable/c/bc03c02cc1991a066b23e69bbcc0f66e8f1f7453
https://git.kernel.org/stable/c/d3887448486caeef9687fb5dfebd4ff91e0f25aa
https://lore.kernel.org/linux-cve-announce/20240326175007.1388794-17-lee@kernel.org/T
https://nvd.nist.gov/vuln/detail/CVE-2024-26649
https://www.cve.org/CVERecord?id=CVE-2024-26649

History

Wed, 11 Sep 2024 18:30:00 +0000

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 11 Sep 2024 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-03-26T17:50:02.226Z

Updated: 2024-09-11T17:33:42.886Z

Reserved: 2024-02-19T14:20:24.138Z

Link: CVE-2024-26649

Vulnrichment

Updated: 2024-08-02T00:07:19.675Z

NVD

Status : Awaiting Analysis

Published: 2024-03-26T18:15:10.370

Modified: 2024-03-27T12:29:41.530

Link: CVE-2024-26649

Redhat

Severity : Moderate

Publid Date: 2024-03-26T00:00:00Z

Links: CVE-2024-26649 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-26649", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.138Z", "datePublished": "2024-03-26T17:50:02.226Z", "dateUpdated": "2024-09-11T17:33:42.886Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T05:20:09.433Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix the null pointer when load rlc firmware\n\nIf the RLC firmware is invalid because of wrong header size,\nthe pointer to the rlc firmware is released in function\namdgpu_ucode_request. There will be a null pointer error\nin subsequent use. So skip validation to fix it."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c"], "versions": [{"version": "3da9b71563cb", "lessThan": "8b5bacce2d13", "status": "affected", "versionType": "git"}, {"version": "3da9b71563cb", "lessThan": "d3887448486c", "status": "affected", "versionType": "git"}, {"version": "3da9b71563cb", "lessThan": "bc03c02cc199", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c"], "versions": [{"version": "6.3", "status": "affected"}, {"version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "custom"}, {"version": "6.6.15", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.7.3", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/8b5bacce2d13dbe648f0bfd3f738ecce8db4978c"}, {"url": "https://git.kernel.org/stable/c/d3887448486caeef9687fb5dfebd4ff91e0f25aa"}, {"url": "https://git.kernel.org/stable/c/bc03c02cc1991a066b23e69bbcc0f66e8f1f7453"}], "title": "drm/amdgpu: Fix the null pointer when load rlc firmware", "x_generator": {"engine": "bippy-a5840b7849dd"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:19.675Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/8b5bacce2d13dbe648f0bfd3f738ecce8db4978c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d3887448486caeef9687fb5dfebd4ff91e0f25aa", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/bc03c02cc1991a066b23e69bbcc0f66e8f1f7453", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26649", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:54:05.853222Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:42.886Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/8b5bacce2d13dbe648f0bfd3f738ecce8db4978c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d3887448486caeef9687fb5dfebd4ff91e0f25aa", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/bc03c02cc1991a066b23e69bbcc0f66e8f1f7453", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:07:19.675Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26649", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:54:05.853222Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:18.311Z"}}], "cna": {"title": "drm/amdgpu: Fix the null pointer when load rlc firmware", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3da9b71563cb", "lessThan": "8b5bacce2d13", "versionType": "git"}, {"status": "affected", "version": "3da9b71563cb", "lessThan": "d3887448486c", "versionType": "git"}, {"status": "affected", "version": "3da9b71563cb", "lessThan": "bc03c02cc199", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"status": "unaffected", "version": "0", "lessThan": "6.3", "versionType": "custom"}, {"status": "unaffected", "version": "6.6.15", "versionType": "custom", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.3", "versionType": "custom", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/8b5bacce2d13dbe648f0bfd3f738ecce8db4978c"}, {"url": "https://git.kernel.org/stable/c/d3887448486caeef9687fb5dfebd4ff91e0f25aa"}, {"url": "https://git.kernel.org/stable/c/bc03c02cc1991a066b23e69bbcc0f66e8f1f7453"}], "x_generator": {"engine": "bippy-a5840b7849dd"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix the null pointer when load rlc firmware\n\nIf the RLC firmware is invalid because of wrong header size,\nthe pointer to the rlc firmware is released in function\namdgpu_ucode_request. There will be a null pointer error\nin subsequent use. So skip validation to fix it."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T05:20:09.433Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26649", "state": "PUBLISHED", "dateUpdated": "2024-09-11T17:33:42.886Z", "dateReserved": "2024-02-19T14:20:24.138Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-03-26T17:50:02.226Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: null pointer when load rlc firmware", "id": "2271796", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2271796"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdgpu: Fix the null pointer when load rlc firmware\nIf the RLC firmware is invalid because of wrong header size,\nthe pointer to the rlc firmware is released in function\namdgpu_ucode_request. There will be a null pointer error\nin subsequent use. So skip validation to fix it.", "A vulnerability was found in the drm/amdgpu driver of Linux Kernel, causing null pointer dereference when attempting to load RLC (Run-Length Coding) firmware. This issue arises if the firmware has an incorrect header size, causing premature release of the firmware pointer in amdgpu_ucode_request(), subsequently attempts to use the nullified pointer result in errors."], "mitigation": {"lang": "en:us", "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."}, "name": "CVE-2024-26649", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-03-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26649\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26649\nhttps://lore.kernel.org/linux-cve-announce/20240326175007.1388794-17-lee@kernel.org/T"], "threat_severity": "Moderate", "upstream_fix": "kernel 6.6.15, kernel 6.7.3, kernel 6.8"}