#VU96530 NULL pointer dereference in Linux kernel - CVE-2024-43902

Vulnerability identifier: #VU96530

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43902

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dm_suspend(), create_eml_sink() and amdgpu_dm_connector_get_modes() functions in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/d0b8b23b9c2ebec693a36fea518d8f13493ad655
https://git.kernel.org/stable/c/83c7f509ef087041604e9572938f82e18b724c9d
https://git.kernel.org/stable/c/4cc2a94d96caeb3c975acdae7351c2f997c32175
https://git.kernel.org/stable/c/1686675405d07f35eae7ff3d13a530034b899df2
https://git.kernel.org/stable/c/8092aa3ab8f7b737a34b71f91492c676a843043a

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.