Log in Start free

Vulnerability · Published Dec 28, 2024 · Assigned by Linux

CVE-2024-56697drm/amdgpu: Fix the memory allocation issue in amdgpu_discovery_get_nps_info()

Medium 5.5

In plain English

A medium-severity null pointer dereference in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 89.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix the memory allocation issue in amdgpu_discovery_get_nps_info() Fix two issues with memory allocation in amdgpu_discovery_get_nps_info() for mem_ranges: - Add a check for allocation failure to avoid dereferencing a null pointer. - As suggested by Christophe, use kvcalloc() for memory allocation, which checks for multiplication overflow. Additionally, assign the output parameters nps_type and range_cnt after the kvcalloc() call to prevent modifying the output parameters in case of an error return.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.12.3-1DEBIAN-CVE-2024-56697
Debian:14linux6.12.3-1DEBIAN-CVE-2024-56697
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-56697
Ubuntu:24.04:LTSlinux-oem-6.116.11.0-1015.15UBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-56697
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-56697
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-56697

Affected products (as reported)

VendorProductVersions
Linux Linux b194d21b9bcc15b50df1bc3ff7428e51c2918a6f – before d14bea4e094871226ea69772d69dab8b7b5f4915b194d21b9bcc15b50df1bc3ff7428e51c2918a6f – before e8f1dbaa0437eba4e8c1d6a6d81eca2e2ce3d197b194d21b9bcc15b50df1bc3ff7428e51c2918a6f – before a1144da794adedb9447437c57d69add56494309d
Linux Linux 6.11

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References