CVE-2024-40926 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't attempt to schedule hpd_work on headless cards If the card doesn't have display hardware, hpd_work and hpd_lock are left uninitialized which causes BUG when attempting to schedule hpd_work on runtime PM resume. Fix it by adding headless flag to DRM and skip any hpd if it's set.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/227349998e5740f14d531b0f0d704e66b1ed3c2f
https://git.kernel.org/stable/c/b96a225377b6602299a03d2ce3c289b68cd41bb7
https://lore.kernel.org/linux-cve-announce/2024071214-CVE-2024-40926-ccdf@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-40926
https://www.cve.org/CVERecord?id=CVE-2024-40926

History

Thu, 12 Sep 2024 08:30:00 +0000

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 11 Sep 2024 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-07-12T12:25:06.435Z

Updated: 2024-09-11T17:34:27.878Z

Reserved: 2024-07-12T12:17:45.583Z

Link: CVE-2024-40926

Vulnrichment

Updated: 2024-08-02T04:39:55.933Z

NVD

Status : Awaiting Analysis

Published: 2024-07-12T13:15:15.403

Modified: 2024-07-12T16:34:58.687

Link: CVE-2024-40926

Redhat

Severity : Moderate

Publid Date: 2024-07-12T00:00:00Z

Links: CVE-2024-40926 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-40926", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-12T12:17:45.583Z", "datePublished": "2024-07-12T12:25:06.435Z", "dateUpdated": "2024-09-11T17:34:27.878Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-07-15T06:51:35.954Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: don't attempt to schedule hpd_work on headless cards\n\nIf the card doesn't have display hardware, hpd_work and hpd_lock are\nleft uninitialized which causes BUG when attempting to schedule hpd_work\non runtime PM resume.\n\nFix it by adding headless flag to DRM and skip any hpd if it's set."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/nouveau/dispnv04/disp.c", "drivers/gpu/drm/nouveau/dispnv50/disp.c", "drivers/gpu/drm/nouveau/nouveau_display.c", "drivers/gpu/drm/nouveau/nouveau_drv.h"], "versions": [{"version": "ae1aadb1eb8d", "lessThan": "227349998e57", "status": "affected", "versionType": "git"}, {"version": "ae1aadb1eb8d", "lessThan": "b96a225377b6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/nouveau/dispnv04/disp.c", "drivers/gpu/drm/nouveau/dispnv50/disp.c", "drivers/gpu/drm/nouveau/nouveau_display.c", "drivers/gpu/drm/nouveau/nouveau_drv.h"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "custom"}, {"version": "6.9.6", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "custom"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/227349998e5740f14d531b0f0d704e66b1ed3c2f"}, {"url": "https://git.kernel.org/stable/c/b96a225377b6602299a03d2ce3c289b68cd41bb7"}], "title": "drm/nouveau: don't attempt to schedule hpd_work on headless cards", "x_generator": {"engine": "bippy-c9c4e1df01b2"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:55.933Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/227349998e5740f14d531b0f0d704e66b1ed3c2f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b96a225377b6602299a03d2ce3c289b68cd41bb7", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40926", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:05:14.721298Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:27.878Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/227349998e5740f14d531b0f0d704e66b1ed3c2f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b96a225377b6602299a03d2ce3c289b68cd41bb7", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:39:55.933Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40926", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:05:14.721298Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:23.284Z"}}], "cna": {"title": "drm/nouveau: don't attempt to schedule hpd_work on headless cards", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ae1aadb1eb8d", "lessThan": "227349998e57", "versionType": "git"}, {"status": "affected", "version": "ae1aadb1eb8d", "lessThan": "b96a225377b6", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/nouveau/dispnv04/disp.c", "drivers/gpu/drm/nouveau/dispnv50/disp.c", "drivers/gpu/drm/nouveau/nouveau_display.c", "drivers/gpu/drm/nouveau/nouveau_drv.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "custom"}, {"status": "unaffected", "version": "6.9.6", "versionType": "custom", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/nouveau/dispnv04/disp.c", "drivers/gpu/drm/nouveau/dispnv50/disp.c", "drivers/gpu/drm/nouveau/nouveau_display.c", "drivers/gpu/drm/nouveau/nouveau_drv.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/227349998e5740f14d531b0f0d704e66b1ed3c2f"}, {"url": "https://git.kernel.org/stable/c/b96a225377b6602299a03d2ce3c289b68cd41bb7"}], "x_generator": {"engine": "bippy-c9c4e1df01b2"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: don't attempt to schedule hpd_work on headless cards\n\nIf the card doesn't have display hardware, hpd_work and hpd_lock are\nleft uninitialized which causes BUG when attempting to schedule hpd_work\non runtime PM resume.\n\nFix it by adding headless flag to DRM and skip any hpd if it's set."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-07-15T06:51:35.954Z"}}}, "cveMetadata": {"cveId": "CVE-2024-40926", "state": "PUBLISHED", "dateUpdated": "2024-09-11T17:34:27.878Z", "dateReserved": "2024-07-12T12:17:45.583Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-12T12:25:06.435Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}