CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2024-43895 – drm/amd/display: Skip Recompute DSC Params if no Stream on Link
https://notcve.org/view.php?id=CVE-2024-43895
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Recompute DSC Params if no Stream on Link [why] Encounter NULL pointer dereference uner mst + dsc setup. BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 4 PID: 917 Comm: sway Not tainted 6.3.9-arch1-1 #1 124dc55df4f5272ccb409f39ef4872fc2b3376a2 Hardware name: LENOVO 20NKS01Y00/20NKS01Y00, BIOS R12ET61W(1.31 ) 07/28/2022 RIP: 0010:drm_dp_atomic_find_time_slots+0x5e/0x260 [drm_display_helper] Code: 01 00 00 48 8b 85 60 05 00 00 48 63 80 88 00 00 00 3b 43 28 0f 8d 2e 01 00 00 48 8b 53 30 48 8d 04 80 48 8d 04 c2 48 8b 40 18 <48> 8> RSP: 0018:ffff960cc2df77d8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff8afb87e81280 RCX: 0000000000000224 RDX: ffff8afb9ee37c00 RSI: ffff8afb8da1a578 RDI: ffff8afb87e81280 RBP: ffff8afb83d67000 R08: 0000000000000001 R09: ffff8afb9652f850 R10: ffff960cc2df7908 R11: 0000000000000002 R12: 0000000000000000 R13: ffff8afb8d7688a0 R14: ffff8afb8da1a578 R15: 0000000000000224 FS: 00007f4dac35ce00(0000) GS:ffff8afe30b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000010ddc6000 CR4: 00000000003506e0 Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? plist_add+0xbe/0x100 ? exc_page_fault+0x7c/0x180 ? • https://git.kernel.org/stable/c/282f0a482ee61d5e863512f3c4fcec90216c20d9 https://git.kernel.org/stable/c/718d83f66fb07b2cab89a1fc984613a00e3db18f https://git.kernel.org/stable/c/70275bb960c71d313254473d38c14e7101cee5ad https://git.kernel.org/stable/c/50e376f1fe3bf571d0645ddf48ad37eb58323919 https://git.kernel.org/stable/c/5357141b4c2e2b332b6f11607ba8c5fbc2669a10 •
CVSS: -EPSS: 0%CPEs: 7EXPL: 0CVE-2024-43894 – drm/client: fix null pointer dereference in drm_client_modeset_probe
https://notcve.org/view.php?id=CVE-2024-43894
In the Linux kernel, the following vulnerability has been resolved: drm/client: fix null pointer dereference in drm_client_modeset_probe In drm_client_modeset_probe(), the return value of drm_mode_duplicate() is assigned to modeset->mode, which will lead to a possible NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. • https://git.kernel.org/stable/c/cf13909aee054f5aa667d4b9da0ac7df4f6c1327 https://git.kernel.org/stable/c/24ddda932c43ffe156c7f3c568bed85131c63ae6 https://git.kernel.org/stable/c/5291d4f73452c91e8a11f71207617e3e234d418e https://git.kernel.org/stable/c/c763dfe09425152b6bb0e348900a637c62c2ce52 https://git.kernel.org/stable/c/d64847c383100423aecb6ac5f18be5f4316d9d62 https://git.kernel.org/stable/c/d64fc94f7bb24fc2be0d6bd5df8df926da461a6d https://git.kernel.org/stable/c/612cae53e99ce32a58cb821b3b67199eb6e92dff https://git.kernel.org/stable/c/113fd6372a5bb3689aba8ef5b8a265ed1 •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2024-43893 – serial: core: check uartclk for zero to avoid divide by zero
https://notcve.org/view.php?id=CVE-2024-43893
In the Linux kernel, the following vulnerability has been resolved: serial: core: check uartclk for zero to avoid divide by zero Calling ioctl TIOCSSERIAL with an invalid baud_base can result in uartclk being zero, which will result in a divide by zero error in uart_get_divisor(). The check for uartclk being zero in uart_set_info() needs to be done before other settings are made as subsequent calls to ioctl TIOCSSERIAL for the same port would be impacted if the uartclk check was done where uartclk gets set. Oops: divide error: 0000 PREEMPT SMP KASAN PTI RIP: 0010:uart_get_divisor (drivers/tty/serial/serial_core.c:580) Call Trace: <TASK> serial8250_get_divisor (drivers/tty/serial/8250/8250_port.c:2576 drivers/tty/serial/8250/8250_port.c:2589) serial8250_do_set_termios (drivers/tty/serial/8250/8250_port.c:502 drivers/tty/serial/8250/8250_port.c:2741) serial8250_set_termios (drivers/tty/serial/8250/8250_port.c:2862) uart_change_line_settings (./include/linux/spinlock.h:376 ./include/linux/serial_core.h:608 drivers/tty/serial/serial_core.c:222) uart_port_startup (drivers/tty/serial/serial_core.c:342) uart_startup (drivers/tty/serial/serial_core.c:368) uart_set_info (drivers/tty/serial/serial_core.c:1034) uart_set_info_user (drivers/tty/serial/serial_core.c:1059) tty_set_serial (drivers/tty/tty_io.c:2637) tty_ioctl (drivers/tty/tty_io.c:2647 drivers/tty/tty_io.c:2791) __x64_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:907 fs/ioctl.c:893 fs/ioctl.c:893) do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Rule: add • https://git.kernel.org/stable/c/3bbd90fca824e6fd61fb20f6dd2b0fa5f8b14bba https://git.kernel.org/stable/c/55b2a5d331a6ceb1c4372945fdb77181265ba24f https://git.kernel.org/stable/c/52b138f1021113e593ee6ad258ce08fe90693a9e https://git.kernel.org/stable/c/9196e42a3b8eeff1707e6ef769112b4b6096be49 https://git.kernel.org/stable/c/e13ba3fe5ee070f8a9dab60029d52b1f61da5051 https://git.kernel.org/stable/c/e3ad503876283ac3fcca922a1bf243ef9eb0b0e2 https://git.kernel.org/stable/c/68dc02f319b9ee54dc23caba742a5c754d1cccc8 https://git.kernel.org/stable/c/6eabce6608d6f3440f4c03aa3d3ef50a4 •
CVSS: 4.7EPSS: 0%CPEs: 8EXPL: 0CVE-2024-43892 – memcg: protect concurrent access to mem_cgroup_idr
https://notcve.org/view.php?id=CVE-2024-43892
In the Linux kernel, the following vulnerability has been resolved: memcg: protect concurrent access to mem_cgroup_idr Commit 73f576c04b94 ("mm: memcontrol: fix cgroup creation failure after many small jobs") decoupled the memcg IDs from the CSS ID space to fix the cgroup creation failures. It introduced IDR to maintain the memcg ID space. The IDR depends on external synchronization mechanisms for modifications. For the mem_cgroup_idr, the idr_alloc() and idr_replace() happen within css callback and thus are protected through cgroup_mutex from concurrent modifications. However idr_remove() for mem_cgroup_idr was not protected against concurrency and can be run concurrently for different memcgs when they hit their refcnt to zero. • https://git.kernel.org/stable/c/73f576c04b9410ed19660f74f97521bee6e1c546 https://git.kernel.org/stable/c/8627c7750a66a46d56d3564e1e881aa53764497c https://git.kernel.org/stable/c/db70cd18d3da727a3a59694de428a9e41c620de7 https://git.kernel.org/stable/c/912736a0435ef40e6a4ae78197ccb5553cb80b05 https://git.kernel.org/stable/c/e6cc9ff2ac0b5df9f25eb790934c3104f6710278 https://git.kernel.org/stable/c/56fd70f4aa8b82199dbe7e99366b1fd7a04d86fb https://git.kernel.org/stable/c/37a060b64ae83b76600d187d76591ce488ab836b https://git.kernel.org/stable/c/51c0b1bb7541f8893ec1accba59eb0436 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-43891 – tracing: Have format file honor EVENT_FILE_FL_FREED
https://notcve.org/view.php?id=CVE-2024-43891
In the Linux kernel, the following vulnerability has been resolved: tracing: Have format file honor EVENT_FILE_FL_FREED When eventfs was introduced, special care had to be done to coordinate the freeing of the file meta data with the files that are exposed to user space. The file meta data would have a ref count that is set when the file is created and would be decremented and freed after the last user that opened the file closed it. When the file meta data was to be freed, it would set a flag (EVENT_FILE_FL_FREED) to denote that the file is freed, and any new references made (like new opens or reads) would fail as it is marked freed. This allowed other meta data to be freed after this flag was set (under the event_mutex). All the files that were dynamically created in the events directory had a pointer to the file meta data and would call event_release() when the last reference to the user space file was closed. This would be the time that it is safe to free the file meta data. A shortcut was made for the "format" file. • https://git.kernel.org/stable/c/14aa4f3efc6e784847e8c8543a7ef34ec9bdbb01 https://git.kernel.org/stable/c/b63db58e2fa5d6963db9c45df88e60060f0ff35f https://git.kernel.org/stable/c/4ed03758ddf0b19d69eed69386d65a92d0091e0c https://git.kernel.org/stable/c/531dc6780d94245af037c25c2371c8caf652f0f9 https://git.kernel.org/stable/c/b1560408692cd0ab0370cfbe9deb03ce97ab3f6d •