CVE-2024-47720

一、漏洞信息
 漏洞编号：[CVE-2024-47720](https://nvd.nist.gov/vuln/detail/CVE-2024-47720)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：5.5 Medium
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_funcThis commit adds a null check for the set_output_gamma function pointerin the  dcn30_set_output_transfer_func function. Previously,set_output_gamma was being checked for nullity at line 386, but then itwas being dereferenced without any nullity check at line 401. Thiscould potentially lead to a null pointer dereference error ifset_output_gamma is indeed null.To fix this, we now ensure that set_output_gamma is not null beforedereferencing it. We do this by adding a nullity check forset_output_gamma before the call to set_output_gamma at line 401. Ifset_output_gamma is null, we log an error message and do not call thefunction.This fix prevents a potential null pointer dereference error.drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401 dcn30_set_output_transfer_func()error: we previously assumed  mpc->funcs->set_output_gamma  could be null (see line 386)drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c    373 bool dcn30_set_output_transfer_func(struct dc *dc,    374                                 struct pipe_ctx *pipe_ctx,    375                                 const struct dc_stream_state *stream)    376 {    377         int mpcc_id = pipe_ctx->plane_res.hubp->inst;    378         struct mpc *mpc = pipe_ctx->stream_res.opp->ctx->dc->res_pool->mpc;    379         const struct pwl_params *params = NULL;    380         bool ret = false;    381    382         /* program OGAM or 3DLUT only for the top pipe*/    383         if (pipe_ctx->top_pipe == NULL) {    384                 /*program rmu shaper and 3dlut in MPC*/    385                 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream);    386                 if (ret == false && mpc->funcs->set_output_gamma) {                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If this is NULL    387                         if (stream->out_transfer_func.type == TF_TYPE_HWPWL)    388                                 params = &stream->out_transfer_func.pwl;    389                         else if (pipe_ctx->stream->out_transfer_func.type ==    390                                         TF_TYPE_DISTRIBUTED_POINTS &&    391                                         cm3_helper_translate_curve_to_hw_format(    392                                         &stream->out_transfer_func,    393                                         &mpc->blender_params, false))    394                                 params = &mpc->blender_params;    395                          /* there are no ROM LUTs in OUTGAM */    396                         if (stream->out_transfer_func.type == TF_TYPE_PREDEFINED)    397                                 BREAK_TO_DEBUGGER();    398                 }    399         }    400--> 401         mpc->funcs->set_output_gamma(mpc, mpcc_id, params);                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Then it will crash    402         return ret;    403 }
 漏洞公开时间：2024-10-21 20:15:08
 漏洞创建时间：2024-10-21 20:42:41
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-47720
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/08ae395ea22fb3d9b318c8bde28c0dfd2f5fa4d2 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/44948d3cb943602ba4a0b5ed3c91ae0525838fb1 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/64886a4e6f1dce843c0889505cf0673b5211e16a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/72ee32d0907364104fbcf4f68dd5ae63cd8eae9e |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/84edd5a3f5fa6aafa4afcaf9f101f46426c620c9 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ddf9ff244d704e1903533f7be377615ed34b83e7 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-47720 | https://bugzilla.suse.com/show_bug.cgi?id=1232043 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-47720.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1232043 |
| suse_bugzilla | https://git.kernel.org/stable/c/44948d3cb943602ba4a0b5ed3c91ae0525838fb1 | https://bugzilla.suse.com/show_bug.cgi?id=1232043 |
| suse_bugzilla | https://git.kernel.org/stable/c/64886a4e6f1dce843c0889505cf0673b5211e16a | https://bugzilla.suse.com/show_bug.cgi?id=1232043 |
| suse_bugzilla | https://git.kernel.org/stable/c/ddf9ff244d704e1903533f7be377615ed34b83e7 | https://bugzilla.suse.com/show_bug.cgi?id=1232043 |
| suse_bugzilla | https://git.kernel.org/stable/c/84edd5a3f5fa6aafa4afcaf9f101f46426c620c9 | https://bugzilla.suse.com/show_bug.cgi?id=1232043 |
| suse_bugzilla | https://git.kernel.org/stable/c/72ee32d0907364104fbcf4f68dd5ae63cd8eae9e | https://bugzilla.suse.com/show_bug.cgi?id=1232043 |
| suse_bugzilla | https://git.kernel.org/stable/c/08ae395ea22fb3d9b318c8bde28c0dfd2f5fa4d2 | https://bugzilla.suse.com/show_bug.cgi?id=1232043 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-47720 | https://bugzilla.suse.com/show_bug.cgi?id=1232043 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2320219 | https://bugzilla.suse.com/show_bug.cgi?id=1232043 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024102121-CVE-2024-47720-c007@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2320219 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-47720 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/08ae395ea22fb3d9b318c8bde28c0dfd2f5fa4d2 |  | nvd |
|  |  | https://git.kernel.org/stable/c/44948d3cb943602ba4a0b5ed3c91ae0525838fb1 |  | nvd |
|  |  | https://git.kernel.org/stable/c/64886a4e6f1dce843c0889505cf0673b5211e16a |  | nvd |
|  |  | https://git.kernel.org/stable/c/72ee32d0907364104fbcf4f68dd5ae63cd8eae9e |  | nvd |
|  |  | https://git.kernel.org/stable/c/84edd5a3f5fa6aafa4afcaf9f101f46426c620c9 |  | nvd |
|  |  | https://git.kernel.org/stable/c/ddf9ff244d704e1903533f7be377615ed34b83e7 |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_funcThis commit adds a null check for the set_output_gamma function pointerin the  dcn30_set_output_transfer_func function. Previously,set_output_gamma was being checked for nullity at line 386, but then itwas being dereferenced without any nullity check at line 401. Thiscould potentially lead to a null pointer dereference error ifset_output_gamma is indeed null.To fix this, we now ensure that set_output_gamma is not null beforedereferencing it. We do this by adding a nullity check forset_output_gamma before the call to set_output_gamma at line 401. Ifset_output_gamma is null, we log an error message and do not call thefunction.This fix prevents a potential null pointer dereference error.drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401 dcn30_set_output_transfer_func()error: we previously assumed &#39;mpc-&gt;funcs-&gt;set_output_gamma&#39; could be null (see line 386)drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c    373 bool dcn30_set_output_transfer_func(struct dc *dc,    374                                 struct pipe_ctx *pipe_ctx,    375                                 const struct dc_stream_state *stream)    376 {    377         int mpcc_id = pipe_ctx-&gt;plane_res.hubp-&gt;inst;    378         struct mpc *mpc = pipe_ctx-&gt;stream_res.opp-&gt;ctx-&gt;dc-&gt;res_pool-&gt;mpc;    379         const struct pwl_params *params = NULL;    380         bool ret = false;    381    382         /* program OGAM or 3DLUT only for the top pipe*/    383         if (pipe_ctx-&gt;top_pipe == NULL) {    384                 /*program rmu shaper and 3dlut in MPC*/    385                 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream);    386                 if (ret == false &#38;&#38; mpc-&gt;funcs-&gt;set_output_gamma) {                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If this is NULL    387                         if (stream-&gt;out_transfer_func.type == TF_TYPE_HWPWL)    388                                 params = &#38;stream-&gt;out_transfer_func.pwl;    389                         else if (pipe_ctx-&gt;stream-&gt;out_transfer_func.type ==    390                                         TF_TYPE_DISTRIBUTED_POINTS &#38;&#38;    391                                         cm3_helper_translate_curve_to_hw_format(    392                                         &#38;stream-&gt;out_transfer_func,    393                                         &#38;mpc-&gt;blender_params, false))    394                                 params = &#38;mpc-&gt;blender_params;    395                          /* there are no ROM LUTs in OUTGAM */    396                         if (stream-&gt;out_transfer_func.type == TF_TYPE_PREDEFINED)    397                                 BREAK_TO_DEBUGGER();    398                 }    399         }    400--&gt; 401         mpc-&gt;funcs-&gt;set_output_gamma(mpc, mpcc_id, params);                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Then it will crash    402         return ret;    403 }The Linux kernel CVE team has assigned CVE-2024-47720 to this issue.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP1(5.10.0):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.openEuler-24.03-LTS(6.6.0):受影响
5.openEuler-20.03-LTS-SP4(4.19.90):不受影响
6.master(6.6.0):不受影响
7.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否

原因说明：
  1.master(6.6.0):
2.openEuler-20.03-LTS-SP4(4.19.90):
3.openEuler-22.03-LTS-SP1(5.10.0):
4.openEuler-22.03-LTS-SP3(5.10.0):
5.openEuler-22.03-LTS-SP4(5.10.0):
6.openEuler-24.03-LTS(6.6.0):
7.openEuler-24.03-LTS-Next(6.6.0):

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2325

src-openEuler/kernel
关闭

内容风险标识

评论 (7)

src-openEuler/kernel关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2024-47720

评论 (7)

搜索帮助

src-openEuler/kernel
关闭