| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-49232: drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes() |
| |
| In amdgpu_dm_connector_add_common_modes(), amdgpu_dm_create_common_mode() |
| is assigned to mode and is passed to drm_mode_probed_add() directly after |
| that. drm_mode_probed_add() passes &mode->head to list_add_tail(), and |
| there is a dereference of it in list_add_tail() without recoveries, which |
| could lead to NULL pointer dereference on failure of |
| amdgpu_dm_create_common_mode(). |
| |
| Fix this by adding a NULL check of mode. |
| |
| This bug was found by a static analyzer. |
| |
| Builds with 'make allyesconfig' show no new warnings, |
| and our static analyzer no longer warns about this code. |
| |
| The Linux kernel CVE team has assigned CVE-2022-49232 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.15 with commit e7b07ceef2a650e5ed8ca37997689e086c680daf and fixed in 4.19.238 with commit 2c729dec8c1e3e2892fde5ce8181553860914e74 |
| Issue introduced in 4.15 with commit e7b07ceef2a650e5ed8ca37997689e086c680daf and fixed in 5.4.189 with commit 57f4ad5e286fe4599c8fc63cf89f85f9eec7f9c9 |
| Issue introduced in 4.15 with commit e7b07ceef2a650e5ed8ca37997689e086c680daf and fixed in 5.10.110 with commit 19a7eba284790cfbba2945deb2363cf03ce41648 |
| Issue introduced in 4.15 with commit e7b07ceef2a650e5ed8ca37997689e086c680daf and fixed in 5.15.33 with commit bdc7429708a0772d90c208975694f7c2133b1202 |
| Issue introduced in 4.15 with commit e7b07ceef2a650e5ed8ca37997689e086c680daf and fixed in 5.16.19 with commit f4eaa999fec78dec2a9c2d797438e05cbffb125b |
| Issue introduced in 4.15 with commit e7b07ceef2a650e5ed8ca37997689e086c680daf and fixed in 5.17.2 with commit 639b3b9def0a6a3f316a195d705d14113236e89c |
| Issue introduced in 4.15 with commit e7b07ceef2a650e5ed8ca37997689e086c680daf and fixed in 5.18 with commit 588a70177df3b1777484267584ef38ab2ca899a2 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-49232 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/2c729dec8c1e3e2892fde5ce8181553860914e74 |
| https://git.kernel.org/stable/c/57f4ad5e286fe4599c8fc63cf89f85f9eec7f9c9 |
| https://git.kernel.org/stable/c/19a7eba284790cfbba2945deb2363cf03ce41648 |
| https://git.kernel.org/stable/c/bdc7429708a0772d90c208975694f7c2133b1202 |
| https://git.kernel.org/stable/c/f4eaa999fec78dec2a9c2d797438e05cbffb125b |
| https://git.kernel.org/stable/c/639b3b9def0a6a3f316a195d705d14113236e89c |
| https://git.kernel.org/stable/c/588a70177df3b1777484267584ef38ab2ca899a2 |
