drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.26 % · percentile 18 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported acpi_evaluate_object() may return AE_NOT_FOUND (failure), which would result in dereferencing buffer.pointer (obj) while being NULL. Although this case may be unrealistic for the current code, it is still better to protect against possible bugs. Bail out also when status is AE_NOT_FOUND. This fixes 1 FORWARD_NULL issue reported by Coverity Report: CID 1600951: Null pointer dereferences (FORWARD_NULL) (cherry picked from commit 91c9e221fe2553edf2db71627d8453f083de87a1)
Weaknesses (CWE)
- CWE-476 — NULL Pointer Dereference
References
- https://git.kernel.org/stable/c/ce8a00a00e36f61f5a1e47734332420b68784c43
- https://git.kernel.org/stable/c/8d7a28eca7553d35d4ce192fa1f390f2357df41b
- https://git.kernel.org/stable/c/2ac7f253deada4d449559b65a1c1cd0a6f6f19b7
- https://git.kernel.org/stable/c/27fc29b5376998c126c85cf9b15d9dfc2afc9cbe
- https://git.kernel.org/stable/c/1a9f55ed5b512f510ccd21ad527d532e60550e80
- https://git.kernel.org/stable/c/a613a392417532ca5aaf3deac6e3277aa7aaef2b
- https://git.kernel.org/stable/c/b9d9881237afeb52eddd70077b7174bf17e2fa30
- https://git.kernel.org/stable/c/a6dd15981c03f2cdc9a351a278f09b5479d53d2e
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2024-50470
- GCVE · GCVE-0-2024-53060
CERT-FR advisories
- CERTFR-2025-AVI-0677 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0349 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0184 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0002 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1102 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1031 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*< 4.19.324cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.20 < 5.4.286cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.230cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.172cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.117cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.61cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.11.8cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 58556dcbd5606a5daccaee73b2130bc16b48e025 < ce8a00a00e36f61f5a1e47734332420b68784c43 ; affected 43b4fa6e0e238c6e2662f4fb61d9f51c2785fb1d < 8d7a28eca7553d35d4ce192fa1f390f2357df41b ; affected 234682910971732cd4da96fd95946e296e486b38 < 2ac7f253deada4d449559b65a1c1cd0a6f6f19b7 ; affected 6032287747f874b52dc8b9d7490e2799736e035f < 27fc29b5376998c126c85cf9b15d9dfc2afc9cbe ; affected cd67af3c1762de4c2483ae4dbdd98f9ea8fa56e3 < 1a9f55ed5b512f510ccd21ad527d532e60550e80 ; affected 975ede2a7bec52b5da1428829b3439667c8a234b < a613a392417532ca5aaf3deac6e3277aa7aaef2b |
| Linux · Linux | affected 4.19.323 < 4.19.324 ; affected 5.4.285 < 5.4.286 ; affected 5.10.229 < 5.10.230 ; affected 5.15.170 < 5.15.172 ; affected 6.1.115 < 6.1.117 ; affected 6.6.59 < 6.6.61 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |