CVE-2024-36969
"AMDGPU Linux Kernel Division by Zero Vulnerability"
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix division by zero in setup_dsc_config When slice_height is 0, the division by slice_height in the calculation of the number of slices will cause a division by zero driver crash. This leaves the kernel in a state that requires a reboot. This patch adds a check to avoid the division by zero. The stack trace below is for the 6.8.4 Kernel. I reproduced the issue on a Z16 Gen 2 Lenovo Thinkpad with a Apple Studio Display monitor connected via Thunderbolt. The amdgpu driver crashed with this exception when I rebooted the system with the monitor connected. kernel: ? die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434 arch/x86/kernel/dumpstack.c:447) kernel: ? do_trap (arch/x86/kernel/traps.c:113 arch/x86/kernel/traps.c:154) kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu kernel: ? do_error_trap (./arch/x86/include/asm/traps.h:58 arch/x86/kernel/traps.c:175) kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu kernel: ? exc_divide_error (arch/x86/kernel/traps.c:194 (discriminator 2)) kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu kernel: ? asm_exc_divide_error (./arch/x86/include/asm/idtentry.h:548) kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu kernel: dc_dsc_compute_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1109) amdgpu After applying this patch, the driver no longer crashes when the monitor is connected and the system is rebooted. I believe this is the same issue reported for 3113.
INFO
Published Date :
June 8, 2024, 1:15 p.m.
Last Modified :
July 17, 2024, 4:50 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-36969.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-36969 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-36969 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 17, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Changed Reference Type https://git.kernel.org/stable/c/130afc8a886183a94cf6eab7d24f300014ff87ba No Types Assigned https://git.kernel.org/stable/c/130afc8a886183a94cf6eab7d24f300014ff87ba Patch Changed Reference Type https://git.kernel.org/stable/c/308de6be0c9c7ba36915c0d398e771725c0ea911 No Types Assigned https://git.kernel.org/stable/c/308de6be0c9c7ba36915c0d398e771725c0ea911 Patch Changed Reference Type https://git.kernel.org/stable/c/7e4f50dfc98c49b3dc6875a35c3112522fb25639 No Types Assigned https://git.kernel.org/stable/c/7e4f50dfc98c49b3dc6875a35c3112522fb25639 Patch Changed Reference Type https://git.kernel.org/stable/c/91402e0e5de9124a3108db7a14163fcf9a6d322f No Types Assigned https://git.kernel.org/stable/c/91402e0e5de9124a3108db7a14163fcf9a6d322f Patch Changed Reference Type https://git.kernel.org/stable/c/a32c8f951c8a456c1c251e1dcdf21787f8066445 No Types Assigned https://git.kernel.org/stable/c/a32c8f951c8a456c1c251e1dcdf21787f8066445 Patch Changed Reference Type https://git.kernel.org/stable/c/f187fcbbb8f8bf10c6687f0beae22509369f7563 No Types Assigned https://git.kernel.org/stable/c/f187fcbbb8f8bf10c6687f0beae22509369f7563 Patch Added CWE NIST CWE-369 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 5.15.160 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.92 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.32 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.8.11 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.9 up to (excluding) 6.9.2 -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 08, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix division by zero in setup_dsc_config When slice_height is 0, the division by slice_height in the calculation of the number of slices will cause a division by zero driver crash. This leaves the kernel in a state that requires a reboot. This patch adds a check to avoid the division by zero. The stack trace below is for the 6.8.4 Kernel. I reproduced the issue on a Z16 Gen 2 Lenovo Thinkpad with a Apple Studio Display monitor connected via Thunderbolt. The amdgpu driver crashed with this exception when I rebooted the system with the monitor connected. kernel: ? die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434 arch/x86/kernel/dumpstack.c:447) kernel: ? do_trap (arch/x86/kernel/traps.c:113 arch/x86/kernel/traps.c:154) kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu kernel: ? do_error_trap (./arch/x86/include/asm/traps.h:58 arch/x86/kernel/traps.c:175) kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu kernel: ? exc_divide_error (arch/x86/kernel/traps.c:194 (discriminator 2)) kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu kernel: ? asm_exc_divide_error (./arch/x86/include/asm/idtentry.h:548) kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu kernel: dc_dsc_compute_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1109) amdgpu After applying this patch, the driver no longer crashes when the monitor is connected and the system is rebooted. I believe this is the same issue reported for 3113. Added Reference kernel.org https://git.kernel.org/stable/c/a32c8f951c8a456c1c251e1dcdf21787f8066445 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/91402e0e5de9124a3108db7a14163fcf9a6d322f [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/7e4f50dfc98c49b3dc6875a35c3112522fb25639 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/f187fcbbb8f8bf10c6687f0beae22509369f7563 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/308de6be0c9c7ba36915c0d398e771725c0ea911 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/130afc8a886183a94cf6eab7d24f300014ff87ba [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-36969 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-36969
weaknesses.