From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C88994E1A8 for ; Tue, 26 Mar 2024 17:50:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1711475424; cv=none; b=odEedgHzBuR9yJEpXUb1A7ky0Kxg95ix4hbZJRVlII916bakrlAC6C1FOFsGkn4QwamHbfYT8MmNUYSdtGXHLUzosFQN/mKqh9oWRbxU6aAatR2nttVT2szcJzjVYwQUngMk3G6oNrQPOH4F97TBfdvGCxCCEt9cp5aQwXMUtsU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1711475424; c=relaxed/simple; bh=NZ/ngD5lsedWlTTxVtHoNpA6KPBt2DMGRMsmUBCoCaw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=U6ZrRwJx+Syor9X+aoJ7dcJ98E7kvbiUnMj17HmrM15cFGgMmdD7ZJm5BAsgJ9b0ZYWT0KOI5jDd2SbnCAjYMd3GqLCv8EKHa3E1at3r3x1LQYZUAfUmwzHAnmwvjLa97XsRsWXPkW4biJ0TYerA6PNEsUIBytg6Oau2SqzooEc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=FYUexKiT; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="FYUexKiT" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0B2ECC43394; Tue, 26 Mar 2024 17:50:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1711475424; bh=NZ/ngD5lsedWlTTxVtHoNpA6KPBt2DMGRMsmUBCoCaw=; h=From:To:Cc:Subject:Date:Reply-to:From; b=FYUexKiT2vVeLSVc2FzRCo37Ou4bDgYbsKDMVmcm3HN0BEF3Vr5V74hdgLHqWeXZo M/VgzYjA7hLakkbfC3Wz4FEZU9YN6b7VBu2mfk2l3+RsWn4Tm4Yhn5M/sBcoDkeJdf QzUbepIb0OE8IbVOndV6COTvVWD/WIObtkb8EFwzwTilZrvurcjNW9d4m2i/3PWxJS +D4aZDEai8frnf2A31HdnWyDok5SIzptiXqUT8gikIhL16FcLFFOYUwWW+ZJMmvDme CSRtmtZhVc8MqIpKkgMd2xleyoQNtt/KoAgtXrKQ9aM6BPzziqXzDK86itz8CDFJbt RIOhkXRqu0N8Q== From: Lee Jones To: linux-cve-announce@vger.kernel.org Cc: Lee Jones Subject: CVE-2024-26649: drm/amdgpu: Fix the null pointer when load rlc firmware Date: Tue, 26 Mar 2024 17:50:15 +0000 Message-ID: <20240326175007.1388794-17-lee@kernel.org> X-Mailer: git-send-email 2.44.0.396.g6e790dbe36-goog Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2057; i=lee@kernel.org; h=from:subject; bh=NZ/ngD5lsedWlTTxVtHoNpA6KPBt2DMGRMsmUBCoCaw=; b=owEBbQKS/ZANAwAKAVGvii+H/HdhAcsmYgBmAwrQPQQ5ihB3AbR5fQQUVsNhhq7oTOJ8wEv4H xHiJsL097aJAjMEAAEKAB0WIQR2tsk1o74gmpTwh0hRr4ovh/x3YQUCZgMK0AAKCRBRr4ovh/x3 YSMyD/9cQo9QvcDR4RUSFLKzZ5MlTOFwNDl9YKghn2AAL66gUiqXSajggjgWhtTMSLrp48cIJuj uskkN9AHwPg/JAT1AUb89dglDVexJxhof18mpE4V+SrqEV5N0C5WWSYDQXXZJeydXUzoxKgO/D/ uNUVu4kwu9rPcoiN0yDgU9X1+Z+hR+GFwsph3LIkypEvPLZLhpYosCIjhgq+ZPrwaXiHuhjKljy ngLR0eCcGpmrLkDHPCjjW57fbmIKPgw6ZdbSi1ptaFcO8HL94hwEmsAfONEhaG7sQcuAI8SnuYO zy+3q7OfsU+JjGKY8tLOh7VJV0VeqpGGazWwvjYlKUMDzlX5KToAT7cDfZ9CdAjelWn51XgjKWP p1+LvVkfcTi2s2D2xiQDwof7SHy5aDsQo9qQCgIj2x24y6yXLACkDLYDhpvVUTgaprYl7l8e972 hkBfZmbtn5PRdq+cA5OOVBC5PoAT6QE81qJkhi947QWGualCd9eepQ5ngDOGXp/WP4vuMUJ/czH mgAz9RjJSpNeLpraheV9qhkTJqZkINuge7kpFc9HgIclRKoDN43bwUZDG8ftR9t0yQ+qo0XsdTJ 3izEW9FZWoGWX1nNxFf4m6GLqISgV2VI3vItUVq2++hvcLpU94D2hevEhnlfUH6dnxyoJBiAiZp 8rCc47JiN0ip3DQ== X-Developer-Key: i=lee@kernel.org; a=openpgp; fpr=76B6C935A3BE209A94F0874851AF8A2F87FC7761 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix the null pointer when load rlc firmware If the RLC firmware is invalid because of wrong header size, the pointer to the rlc firmware is released in function amdgpu_ucode_request. There will be a null pointer error in subsequent use. So skip validation to fix it. The Linux kernel CVE team has assigned CVE-2024-26649 to this issue. Affected and fixed versions =========================== Issue introduced in 6.3 with commit 3da9b71563cb and fixed in 6.6.15 with commit 8b5bacce2d13 Issue introduced in 6.3 with commit 3da9b71563cb and fixed in 6.7.3 with commit d3887448486c Issue introduced in 6.3 with commit 3da9b71563cb and fixed in 6.8 with commit bc03c02cc199 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-26649 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/8b5bacce2d13dbe648f0bfd3f738ecce8db4978c https://git.kernel.org/stable/c/d3887448486caeef9687fb5dfebd4ff91e0f25aa https://git.kernel.org/stable/c/bc03c02cc1991a066b23e69bbcc0f66e8f1f7453