CVE-2024-57918

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-57918
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-57918.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-57918
Related
Published
2025-01-19T12:15:25Z
Modified
2025-01-25T23:47:26.259740Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: fix page fault due to max surface definition mismatch

DC driver is using two different values to define the maximum number of surfaces: MAXSURFACES and MAXSURFACENUM. Consolidate MAXSURFACES as the unique definition for surface updates across DC.

It fixes page fault faced by Cosmic users on AMD display versions that support two overlay planes, since the introduction of cursor overlay mode.

[Nov26 21:33] BUG: unable to handle page fault for address: 0000000051d0f08b [ +0.000015] #PF: supervisor read access in kernel mode [ +0.000006] #PF: errorcode(0x0000) - not-present page [ +0.000005] PGD 0 P4D 0 [ +0.000007] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI [ +0.000006] CPU: 4 PID: 71 Comm: kworker/u32:6 Not tainted 6.10.0+ #300 [ +0.000006] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0131 01/30/2024 [ +0.000007] Workqueue: eventsunbound commitwork [drmkmshelper] [ +0.000040] RIP: 0010:copystreamupdatetostream.isra.0+0x30d/0x750 [amdgpu] [ +0.000847] Code: 8b 10 49 89 94 24 f8 00 00 00 48 8b 50 08 49 89 94 24 00 01 00 00 8b 40 10 41 89 84 24 08 01 00 00 49 8b 45 78 48 85 c0 74 0b <0f> b6 00 41 88 84 24 90 64 00 00 49 8b 45 60 48 85 c0 74 3b 48 8b [ +0.000010] RSP: 0018:ffffc203802f79a0 EFLAGS: 00010206 [ +0.000009] RAX: 0000000051d0f08b RBX: 0000000000000004 RCX: ffff9f964f0a8070 [ +0.000004] RDX: ffff9f9710f90e40 RSI: ffff9f96600c8000 RDI: ffff9f964f000000 [ +0.000004] RBP: ffffc203802f79f8 R08: 0000000000000000 R09: 0000000000000000 [ +0.000005] R10: 0000000000000000 R11: 0000000000000000 R12: ffff9f96600c8000 [ +0.000004] R13: ffff9f9710f90e40 R14: ffff9f964f000000 R15: ffff9f96600c8000 [ +0.000004] FS: 0000000000000000(0000) GS:ffff9f9970000000(0000) knlGS:0000000000000000 [ +0.000005] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000005] CR2: 0000000051d0f08b CR3: 00000002e6a20000 CR4: 0000000000350ef0 [ +0.000005] Call Trace: [ +0.000011] <TASK> [ +0.000010] ? _diebody.cold+0x19/0x27 [ +0.000012] ? pagefaultoops+0x15a/0x2d0 [ +0.000014] ? excpagefault+0x7e/0x180 [ +0.000009] ? asmexcpagefault+0x26/0x30 [ +0.000013] ? copystreamupdatetostream.isra.0+0x30d/0x750 [amdgpu] [ +0.000739] ? dccommitstatenocheck+0xd6c/0xe70 [amdgpu] [ +0.000470] updateplanesandstreamstate+0x49b/0x4f0 [amdgpu] [ +0.000450] ? srsoreturnthunk+0x5/0x5f [ +0.000009] ? commitminimaltransitionstate+0x239/0x3d0 [amdgpu] [ +0.000446] updateplanesandstreamv2+0x24a/0x590 [amdgpu] [ +0.000464] ? srsoreturnthunk+0x5/0x5f [ +0.000009] ? sort+0x31/0x50 [ +0.000007] ? amdgpudmatomiccommittail+0x159f/0x3a30 [amdgpu] [ +0.000508] ? srsoreturnthunk+0x5/0x5f [ +0.000009] ? amdgpucrtcgetscanoutposition+0x28/0x40 [amdgpu] [ +0.000377] ? srsoreturnthunk+0x5/0x5f [ +0.000009] ? drmcrtcvblankhelpergetvblanktimestampinternal+0x160/0x390 [drm] [ +0.000058] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? dmafencedefaultwait+0x8c/0x260 [ +0.000010] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? waitforcompletiontimeout+0x13b/0x170 [ +0.000006] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? dmafencewaittimeout+0x108/0x140 [ +0.000010] ? committail+0x94/0x130 [drmkmshelper] [ +0.000024] ? processonework+0x177/0x330 [ +0.000008] ? workerthread+0x266/0x3a0 [ +0.000006] ? _pfxworkerthread+0x10/0x10 [ +0.000004] ? kthread+0xd2/0x100 [ +0.000006] ? _pfxkthread+0x10/0x10 [ +0.000006] ? retfromfork+0x34/0x50 [ +0.000004] ? _pfxkthread+0x10/0x10 [ +0.000005] ? retfromfork_asm+0x1a/0x30 [ +0.000011] </TASK>

(cherry picked from commit 1c86c81a86c60f9b15d3e3f43af0363cf56063e7)

References

Affected packages

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.12.10-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1
6.1.98-1
6.1.99-1
6.1.106-1
6.1.106-2
6.1.106-3
6.1.112-1
6.1.115-1
6.1.119-1
6.1.123-1
6.1.124-1
6.3.1-1~exp1
6.3.2-1~exp1
6.3.4-1~exp1
6.3.5-1~exp1
6.3.7-1~bpo12+1
6.3.7-1
6.3.11-1
6.4~rc6-1~exp1
6.4~rc7-1~exp1
6.4.1-1~exp1
6.4.4-1~bpo12+1
6.4.4-1
6.4.4-2
6.4.4-3~bpo12+1
6.4.4-3
6.4.11-1
6.4.13-1
6.5~rc4-1~exp1
6.5~rc6-1~exp1
6.5~rc7-1~exp1
6.5.1-1~exp1
6.5.3-1~bpo12+1
6.5.3-1
6.5.6-1
6.5.8-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.13-1
6.6.3-1~exp1
6.6.4-1~exp1
6.6.7-1~exp1
6.6.8-1
6.6.9-1
6.6.11-1
6.6.13-1~bpo12+1
6.6.13-1
6.6.15-1
6.6.15-2
6.7-1~exp1
6.7.1-1~exp1
6.7.4-1~exp1
6.7.7-1
6.7.9-1
6.7.9-2
6.7.12-1~bpo12+1
6.7.12-1
6.8.9-1
6.8.11-1
6.8.12-1~bpo12+1
6.8.12-1
6.9.2-1~exp1
6.9.7-1~bpo12+1
6.9.7-1
6.9.8-1
6.9.9-1
6.9.10-1~bpo12+1
6.9.10-1
6.9.11-1
6.9.12-1
6.10-1~exp1
6.10.1-1~exp1
6.10.3-1
6.10.4-1
6.10.6-1~bpo12+1
6.10.6-1
6.10.7-1
6.10.9-1
6.10.11-1~bpo12+1
6.10.11-1
6.10.12-1
6.11~rc4-1~exp1
6.11~rc5-1~exp1
6.11-1~exp1
6.11.2-1
6.11.4-1
6.11.5-1~bpo12+1
6.11.5-1
6.11.6-1
6.11.7-1
6.11.9-1
6.11.10-1~bpo12+1
6.11.10-1
6.12~rc6-1~exp1
6.12.3-1
6.12.5-1
6.12.6-1
6.12.8-1
6.12.9-1~bpo12+1
6.12.9-1
6.12.9-1+alpha

Ecosystem specific 

{
    "urgency": "not yet assigned"
}