linux-cve-announce - CVE-2024-26938: drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Wed,  1 May 2024 07:21:28 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-26938: drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode()

If we have no VBT, or the VBT didn't declare the encoder
in question, we won't have the 'devdata' for the encoder.
Instead of oopsing just bail early.

We won't be able to tell whether the port is DP++ or not,
but so be it.

(cherry picked from commit 26410896206342c8a80d2b027923e9ee7d33b733)

The Linux kernel CVE team has assigned CVE-2024-26938 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.1.84 with commit 72e4d3fb72e9
	Fixed in 6.6.24 with commit a891add409e3
	Fixed in 6.7.12 with commit f4bbac954d8f
	Fixed in 6.8.3 with commit 94cf2fb6fecc
	Fixed in 6.9-rc2 with commit 32e39bab5993

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-26938
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/i915/display/intel_bios.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/72e4d3fb72e9f0f016946158a7d95304832768e6
	https://git.kernel.org/stable/c/a891add409e3bc381f4f68c2ce9d953f1865cb1f
	https://git.kernel.org/stable/c/f4bbac954d8f9ab214ea1d4f385de4fa6bd92dd0
	https://git.kernel.org/stable/c/94cf2fb6feccd625e5b4e23e1b70f39a206f82ac
	https://git.kernel.org/stable/c/32e39bab59934bfd3f37097d4dd85ac5eb0fd549