CVSS: -EPSS: %CPEs: 7EXPL: 0CVE-2024-49924 – fbdev: pxafb: Fix possible use after free in pxafb_task()
https://notcve.org/view.php?id=CVE-2024-49924
In the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fix possible use after free in pxafb_task() In the pxafb_probe function, it calls the pxafb_init_fbinfo function, after which &fbi->task is associated with pxafb_task. Moreover, within this pxafb_init_fbinfo function, the pxafb_blank function within the &pxafb_ops struct is capable of scheduling work. If we remove the module which will call pxafb_remove to make cleanup, it will call unregister_framebuffer function which can call do_unregister_framebuffer to free fbi->fb through put_fb_info(fb_info), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | pxafb_task pxafb_remove | unregister_framebuffer(info) | do_unregister_framebuffer(fb_info) | put_fb_info(fb_info) | // free fbi->fb | set_ctrlr_state(fbi, state) | __pxafb_lcd_power(fbi, 0) | fbi->lcd_power(on, &fbi->fb.var) | //use fbi->fb Fix it by ensuring that the work is canceled before proceeding with the cleanup in pxafb_remove. Note that only root user can remove the driver at runtime. • https://git.kernel.org/stable/c/e6897e299f57b103e999e62010b88e363b3eebae https://git.kernel.org/stable/c/4cda484e584be34d55ee17436ebf7ad11922b97a https://git.kernel.org/stable/c/3c0d416eb4bef705f699213cee94bf54b6acdacd https://git.kernel.org/stable/c/fdda354f60a576d52dcf90351254714681df4370 https://git.kernel.org/stable/c/aaadc0cb05c999ccd8898a03298b7e5c31509b08 https://git.kernel.org/stable/c/a3a855764dbacbdb1cc51e15dc588f2d21c93e0e https://git.kernel.org/stable/c/4a6921095eb04a900e0000da83d9475eb958e61e •
CVSS: -EPSS: %CPEs: 3EXPL: 0CVE-2024-49923 – drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags
https://notcve.org/view.php?id=CVE-2024-49923
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags [WHAT & HOW] "dcn20_validate_apply_pipe_split_flags" dereferences merge, and thus it cannot be a null pointer. Let's pass a valid pointer to avoid null dereference. This fixes 2 FORWARD_NULL issues reported by Coverity. • https://git.kernel.org/stable/c/85aa996ecfaa95d1e922867390502d23ce21b905 https://git.kernel.org/stable/c/9a05270869f40c89f8d184fe2d37cb86e0d7e5f5 https://git.kernel.org/stable/c/5559598742fb4538e4c51c48ef70563c49c2af23 •
CVSS: -EPSS: %CPEs: 3EXPL: 0CVE-2024-49922 – drm/amd/display: Check null pointers before using them
https://notcve.org/view.php?id=CVE-2024-49922
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointers before using them [WHAT & HOW] These pointers are null checked previously in the same function, indicating they might be null as reported by Coverity. As a result, they need to be checked when used again. This fixes 3 FORWARD_NULL issue reported by Coverity. • https://git.kernel.org/stable/c/65e1d2c291553ef3f433a0b7109cc3002a5f40ae https://git.kernel.org/stable/c/5e9386baa3033c369564d55de4bab62423e8a1d3 https://git.kernel.org/stable/c/1ff12bcd7deaeed25efb5120433c6a45dd5504a8 •
CVSS: -EPSS: %CPEs: 2EXPL: 0CVE-2024-49921 – drm/amd/display: Check null pointers before used
https://notcve.org/view.php?id=CVE-2024-49921
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointers before used [WHAT & HOW] Poniters, such as dc->clk_mgr, are null checked previously in the same function, so Coverity warns "implies that "dc->clk_mgr" might be null". As a result, these pointers need to be checked when used again. This fixes 10 FORWARD_NULL issues reported by Coverity. • https://git.kernel.org/stable/c/5b35bf1a82eb29841b67ff5643ba83762250fc24 https://git.kernel.org/stable/c/be1fb44389ca3038ad2430dac4234669bc177ee3 •
CVSS: -EPSS: %CPEs: 2EXPL: 0CVE-2024-49920 – drm/amd/display: Check null pointers before multiple uses
https://notcve.org/view.php?id=CVE-2024-49920
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointers before multiple uses [WHAT & HOW] Poniters, such as stream_enc and dc->bw_vbios, are null checked previously in the same function, so Coverity warns "implies that stream_enc and dc->bw_vbios might be null". They are used multiple times in the subsequent code and need to be checked. This fixes 10 FORWARD_NULL issues reported by Coverity. • https://git.kernel.org/stable/c/26787fb6c2b2ee0d1a7e1574b36f4711ae40fe27 https://git.kernel.org/stable/c/fdd5ecbbff751c3b9061d8ebb08e5c96119915b4 •