CVE-2024-57919

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-57919
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-57919.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-57919
Related
Published
2025-01-19T12:15:26Z
Modified
2025-02-18T18:50:22.762251Z
Downstream
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: fix divide error in DM plane scale calcs

dmgetplanescale doesn't take into account plane scaled size equal to zero, leading to a kernel oops due to division by zero. Fix by setting out-scale size as zero when the dst size is zero, similar to what is done by drmcalcscale(). This issue started with the introduction of cursor ovelay mode that uses this function to assess cursor mode changes via dmcrtcgetcursor_mode() before checking plane state.

[Dec17 17:14] Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI [ +0.000018] CPU: 5 PID: 1660 Comm: surface-DP-1 Not tainted 6.10.0+ #231 [ +0.000007] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0131 01/30/2024 [ +0.000004] RIP: 0010:dmgetplanescale+0x3f/0x60 [amdgpu] [ +0.000553] Code: 44 0f b7 41 3a 44 0f b7 49 3e 83 e0 0f 48 0f a3 c2 73 21 69 41 28 e8 03 00 00 31 d2 41 f7 f1 31 d2 89 06 69 41 2c e8 03 00 00 <41> f7 f0 89 07 e9 d7 d8 7e e9 44 89 c8 45 89 c1 41 89 c0 eb d4 66 [ +0.000005] RSP: 0018:ffffa8df0de6b8a0 EFLAGS: 00010246 [ +0.000006] RAX: 00000000000003e8 RBX: ffff9ac65c1f6e00 RCX: ffff9ac65d055500 [ +0.000003] RDX: 0000000000000000 RSI: ffffa8df0de6b8b0 RDI: ffffa8df0de6b8b4 [ +0.000004] RBP: ffff9ac64e7a5800 R08: 0000000000000000 R09: 0000000000000a00 [ +0.000003] R10: 00000000000000ff R11: 0000000000000054 R12: ffff9ac6d0700010 [ +0.000003] R13: ffff9ac65d054f00 R14: ffff9ac65d055500 R15: ffff9ac64e7a60a0 [ +0.000004] FS: 00007f869ea00640(0000) GS:ffff9ac970080000(0000) knlGS:0000000000000000 [ +0.000004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000003] CR2: 000055ca701becd0 CR3: 000000010e7f2000 CR4: 0000000000350ef0 [ +0.000004] Call Trace: [ +0.000007] <TASK> [ +0.000006] ? _diebody.cold+0x19/0x27 [ +0.000009] ? die+0x2e/0x50 [ +0.000007] ? dotrap+0xca/0x110 [ +0.000007] ? doerrortrap+0x6a/0x90 [ +0.000006] ? dmgetplanescale+0x3f/0x60 [amdgpu] [ +0.000504] ? excdivideerror+0x38/0x50 [ +0.000005] ? dmgetplanescale+0x3f/0x60 [amdgpu] [ +0.000488] ? asmexcdivideerror+0x1a/0x20 [ +0.000011] ? dmgetplanescale+0x3f/0x60 [amdgpu] [ +0.000593] dmcrtcgetcursormode+0x33f/0x430 [amdgpu] [ +0.000562] amdgpudmatomiccheck+0x2ef/0x1770 [amdgpu] [ +0.000501] drmatomiccheckonly+0x5e1/0xa30 [drm] [ +0.000047] drmmodeatomicioctl+0x832/0xcb0 [drm] [ +0.000050] ? _pfxdrmmodeatomicioctl+0x10/0x10 [drm] [ +0.000047] drmioctlkernel+0xb3/0x100 [drm] [ +0.000062] drmioctl+0x27a/0x4f0 [drm] [ +0.000049] ? _pfxdrmmodeatomicioctl+0x10/0x10 [drm] [ +0.000055] amdgpudrmioctl+0x4e/0x90 [amdgpu] [ +0.000360] _x64sysioctl+0x97/0xd0 [ +0.000010] dosyscall64+0x82/0x190 [ +0.000008] ? _pfxdrmmodecreateblobioctl+0x10/0x10 [drm] [ +0.000044] ? srsoreturnthunk+0x5/0x5f [ +0.000006] ? drmioctlkernel+0xb3/0x100 [drm] [ +0.000040] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? _checkobjectsize+0x50/0x220 [ +0.000007] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? drmioctl+0x2a4/0x4f0 [drm] [ +0.000039] ? _pfxdrmmodecreateblobioctl+0x10/0x10 [drm] [ +0.000043] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? _pmruntimesuspend+0x69/0xc0 [ +0.000006] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? amdgpudrmioctl+0x71/0x90 [amdgpu] [ +0.000366] ? srsoreturnthunk+0x5/0x5f [ +0.000006] ? syscallexittousermode+0x77/0x210 [ +0.000007] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? dosyscall64+0x8e/0x190 [ +0.000006] ? srsoreturnthunk+0x5/0x5f [ +0.000006] ? dosyscall64+0x8e/0x190 [ +0.000006] ? srsoreturnthunk+0x5/0x5f [ +0.000007] entrySYSCALL64afterhwframe+0x76/0x7e [ +0.000008] RIP: 0033:0x55bb7cd962bc [ +0.000007] Code: 4c 89 6c 24 18 4c 89 64 24 20 4c 89 74 24 28 0f 57 c0 0f 11 44 24 30 89 c7 48 8d 54 24 08 b8 10 00 00 00 be bc 64 ---truncated---

References

Affected packages

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.12.10-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1
6.1.98-1
6.1.99-1
6.1.106-1
6.1.106-2
6.1.106-3
6.1.112-1
6.1.115-1
6.1.119-1
6.1.123-1
6.1.124-1
6.1.128-1
6.3.1-1~exp1
6.3.2-1~exp1
6.3.4-1~exp1
6.3.5-1~exp1
6.3.7-1~bpo12+1
6.3.7-1
6.3.11-1
6.4~rc6-1~exp1
6.4~rc7-1~exp1
6.4.1-1~exp1
6.4.4-1~bpo12+1
6.4.4-1
6.4.4-2
6.4.4-3~bpo12+1
6.4.4-3
6.4.11-1
6.4.13-1
6.5~rc4-1~exp1
6.5~rc6-1~exp1
6.5~rc7-1~exp1
6.5.1-1~exp1
6.5.3-1~bpo12+1
6.5.3-1
6.5.6-1
6.5.8-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.13-1
6.6.3-1~exp1
6.6.4-1~exp1
6.6.7-1~exp1
6.6.8-1
6.6.9-1
6.6.11-1
6.6.13-1~bpo12+1
6.6.13-1
6.6.15-1
6.6.15-2
6.7-1~exp1
6.7.1-1~exp1
6.7.4-1~exp1
6.7.7-1
6.7.9-1
6.7.9-2
6.7.12-1~bpo12+1
6.7.12-1
6.8.9-1
6.8.11-1
6.8.12-1~bpo12+1
6.8.12-1
6.9.2-1~exp1
6.9.7-1~bpo12+1
6.9.7-1
6.9.8-1
6.9.9-1
6.9.10-1~bpo12+1
6.9.10-1
6.9.11-1
6.9.12-1
6.10-1~exp1
6.10.1-1~exp1
6.10.3-1
6.10.4-1
6.10.6-1~bpo12+1
6.10.6-1
6.10.7-1
6.10.9-1
6.10.11-1~bpo12+1
6.10.11-1
6.10.12-1
6.11~rc4-1~exp1
6.11~rc5-1~exp1
6.11-1~exp1
6.11.2-1
6.11.4-1
6.11.5-1~bpo12+1
6.11.5-1
6.11.6-1
6.11.7-1
6.11.9-1
6.11.10-1~bpo12+1
6.11.10-1
6.12~rc6-1~exp1
6.12.3-1
6.12.5-1
6.12.6-1
6.12.8-1
6.12.9-1~bpo12+1
6.12.9-1
6.12.9-1+alpha

Ecosystem specific 

{
    "urgency": "not yet assigned"
}