Log in Start free

Vulnerability · Published Nov 5, 2024 · Assigned by Linux

CVE-2024-50117drm/amd: Guard against bad data for ATIF ACPI method

High 7.3

In plain English

A high-severity null pointer dereference in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 83.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: drm/amd: Guard against bad data for ATIF ACPI method If a BIOS provides bad data in response to an ATIF method call this causes a NULL pointer dereference in the caller. ``` ? show_regs (arch/x86/kernel/dumpstack.c:478 (discriminator 1)) ? __die (arch/x86/kernel/dumpstack.c:423 arch/x86/kernel/dumpstack.c:434) ? page_fault_oops (arch/x86/mm/fault.c:544 (discriminator 2) arch/x86/mm/fault.c:705 (discriminator 2)) ? do_user_addr_fault (arch/x86/mm/fault.c:440 (discriminator 1) arch/x86/mm/fault.c:1232 (discriminator 1)) ? acpi_ut_update_object_reference (drivers/acpi/acpica/utdelete.c:642) ? exc_page_fault (arch/x86/mm/fault.c:1542) ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623) ? amdgpu_atif_query_backlight_caps.constprop.0 (drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c:387 (discriminator 2)) amdgpu ? amdgpu_atif_query_backlight_caps.constprop.0 (drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c:386 (discriminator 1)) amdgpu ``` It has been encountered on at least one system, so guard for it. (cherry picked from commit c9b7c809b89f24e9372a4e7f02d64c950b07fdee)

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.115-1DEBIAN-CVE-2024-50117
Debian:13linux6.11.6-1DEBIAN-CVE-2024-50117
Debian:14linux6.11.6-1DEBIAN-CVE-2024-50117
Ubuntu:22.04:LTSlinux5.15.0-133.144USN-7288-1
Ubuntu:22.04:LTSlinux5.15.0-133.144UBUNTU-CVE-2024-50117
Ubuntu:24.04:LTSlinux6.8.0-56.58UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-aws5.15.0-1078.85USN-7308-1
Ubuntu:22.04:LTSlinux-aws5.15.0-1078.85UBUNTU-CVE-2024-50117
Ubuntu:24.04:LTSlinux-aws6.8.0-1025.27UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1027.29~22.04.1UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-azure5.15.0-1081.90UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-azure5.15.0-1081.90USN-7289-1
Ubuntu:24.04:LTSlinux-azure6.8.0-1025.30UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-50117
Ubuntu:24.04:LTSlinux-azure-6.116.11.0-1012.12~24.04.1UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1025.30~22.04.1UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1081.90.1UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1081.90.1USN-7289-1
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-50117
Ubuntu:24.04:LTSlinux-azure-nvidia6.8.0-1014.15UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-gcp5.15.0-1077.86UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-gcp5.15.0-1077.86USN-7291-1
Ubuntu:24.04:LTSlinux-gcp6.8.0-1026.28UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-50117
Ubuntu:24.04:LTSlinux-gcp-6.116.11.0-1011.11~24.04.1UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1026.28~22.04.1UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-gke5.15.0-1075.81USN-7291-1
Ubuntu:22.04:LTSlinux-gke5.15.0-1075.81UBUNTU-CVE-2024-50117
Ubuntu:24.04:LTSlinux-gke6.8.0-1021.25UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1060.68UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1060.68USN-7289-1
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1008.10UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-57.59~22.04.1UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-ibm5.15.0-1070.73UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-ibm5.15.0-1070.73USN-7289-3
Ubuntu:24.04:LTSlinux-ibm6.8.0-1022.22UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1023.23~22.04.1UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1073.79UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1073.79USN-7289-4
Ubuntu:22.04:LTSlinux-kvm5.15.0-1076.81UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-133.143USN-7288-1
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-133.143UBUNTU-CVE-2024-50117
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-56.58.1UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-56.58.1~22.04.1UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1072.73UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1072.73USN-7289-1
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1024.27UBUNTU-CVE-2024-50117
Ubuntu:24.04:LTSlinux-nvidia-6.116.11.0-1007.7UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1024.27~22.04.1UBUNTU-CVE-2024-50117
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1024.27.1UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1033.33UBUNTU-CVE-2024-50117
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1004.4UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1021.21UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-50117
Ubuntu:24.04:LTSlinux-oem-6.116.11.0-1015.15UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-50117
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1024.24UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-oracle5.15.0-1075.81USN-7289-1
Ubuntu:22.04:LTSlinux-oracle5.15.0-1075.81UBUNTU-CVE-2024-50117
Ubuntu:24.04:LTSlinux-oracle6.8.0-1022.23UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1022.23~22.04.1UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-raspi5.15.0-1072.75USN-7305-1
Ubuntu:22.04:LTSlinux-raspi5.15.0-1072.75UBUNTU-CVE-2024-50117
Ubuntu:24.04:LTSlinux-raspi6.8.0-1028.32UBUNTU-CVE-2024-50117
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-50117
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-50117
Ubuntu:24.04:LTSlinux-riscv6.8.0-56.58.1UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-56.58.1~22.04.1UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-50117
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1017.18UBUNTU-CVE-2024-50117
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1044.48UBUNTU-CVE-2024-50117

Affected products (as reported)

VendorProductVersions
Linux Linux d38ceaf99ed015f2a0b9af3499791bd3a3daae21 – before 58556dcbd5606a5daccaee73b2130bc16b48e025d38ceaf99ed015f2a0b9af3499791bd3a3daae21 – before 43b4fa6e0e238c6e2662f4fb61d9f51c2785fb1dd38ceaf99ed015f2a0b9af3499791bd3a3daae21 – before 234682910971732cd4da96fd95946e296e486b38d38ceaf99ed015f2a0b9af3499791bd3a3daae21 – before 6032287747f874b52dc8b9d7490e2799736e035fd38ceaf99ed015f2a0b9af3499791bd3a3daae21 – before cd67af3c1762de4c2483ae4dbdd98f9ea8fa56e3d38ceaf99ed015f2a0b9af3499791bd3a3daae21 – before 975ede2a7bec52b5da1428829b3439667c8a234bd38ceaf99ed015f2a0b9af3499791bd3a3daae21 – before 1d7175f9c57b1abf9ecfbdfd53ea760761f52ffed38ceaf99ed015f2a0b9af3499791bd3a3daae21 – before bf58f03931fdcf7b3c45cb76ac13244477a60f44
Linux Linux 4.2

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

References