Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Buy Us a Coffee

CVE-2024-43901— drm/amd/display: Fix NULL pointer dereference for DTN log in DCN401

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在访问DCN401的DTN日志时存在空指针取消引用问题。

AI Predicted 5.5 Difficulty: Trivial EPSS 0.18% · P8 Updated May 13, 2026

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 6

Vendor	Product	Version Range	Status
Linux	Linux	`4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c< 1e68b7ce6bc6073579fe8713ec6b85aa9cd2e351`	affected
		`4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c< 5af757124792817f8eb1bd0c80ad60fab519586b`	affected
		`4.15`	affected
		`< 4.15`	unaffected
		`6.10.5≤ 6.10.*`	unaffected
		`6.11≤ *`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-43901

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

drm/amd/display: Fix NULL pointer dereference for DTN log in DCN401

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference for DTN log in DCN401 When users run the command: cat /sys/kernel/debug/dri/0/amdgpu_dm_dtn_log The following NULL pointer dereference happens: [ +0.000003] BUG: kernel NULL pointer dereference, address: NULL [ +0.000005] #PF: supervisor instruction fetch in kernel mode [ +0.000002] #PF: error_code(0x0010) - not-present page [ +0.000002] PGD 0 P4D 0 [ +0.000004] Oops: 0010 [#1] PREEMPT SMP NOPTI [ +0.000003] RIP: 0010:0x0 [ +0.000008] Code: Unable to access opcode bytes at 0xffffffffffffffd6. [...] [ +0.000002] PKRU: 55555554 [ +0.000002] Call Trace: [ +0.000002] <TASK> [ +0.000003] ? show_regs+0x65/0x70 [ +0.000006] ? __die+0x24/0x70 [ +0.000004] ? page_fault_oops+0x160/0x470 [ +0.000006] ? do_user_addr_fault+0x2b5/0x690 [ +0.000003] ? prb_read_valid+0x1c/0x30 [ +0.000005] ? exc_page_fault+0x8c/0x1a0 [ +0.000005] ? asm_exc_page_fault+0x27/0x30 [ +0.000012] dcn10_log_color_state+0xf9/0x510 [amdgpu] [ +0.000306] ? srso_alias_return_thunk+0x5/0xfbef5 [ +0.000003] ? vsnprintf+0x2fb/0x600 [ +0.000009] dcn10_log_hw_state+0xfd0/0xfe0 [amdgpu] [ +0.000218] ? __mod_memcg_lruvec_state+0xe8/0x170 [ +0.000008] ? srso_alias_return_thunk+0x5/0xfbef5 [ +0.000002] ? debug_smp_processor_id+0x17/0x20 [ +0.000003] ? srso_alias_return_thunk+0x5/0xfbef5 [ +0.000002] ? srso_alias_return_thunk+0x5/0xfbef5 [ +0.000002] ? set_ptes.isra.0+0x2b/0x90 [ +0.000004] ? srso_alias_return_thunk+0x5/0xfbef5 [ +0.000002] ? _raw_spin_unlock+0x19/0x40 [ +0.000004] ? srso_alias_return_thunk+0x5/0xfbef5 [ +0.000002] ? do_anonymous_page+0x337/0x700 [ +0.000004] dtn_log_read+0x82/0x120 [amdgpu] [ +0.000207] full_proxy_read+0x66/0x90 [ +0.000007] vfs_read+0xb0/0x340 [ +0.000005] ? __count_memcg_events+0x79/0xe0 [ +0.000002] ? srso_alias_return_thunk+0x5/0xfbef5 [ +0.000003] ? count_memcg_events.constprop.0+0x1e/0x40 [ +0.000003] ? handle_mm_fault+0xb2/0x370 [ +0.000003] ksys_read+0x6b/0xf0 [ +0.000004] __x64_sys_read+0x19/0x20 [ +0.000003] do_syscall_64+0x60/0x130 [ +0.000004] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ +0.000003] RIP: 0033:0x7fdf32f147e2 [...] This error happens when the color log tries to read the gamut remap information from DCN401 which is not initialized in the dcn401_dpp_funcs which leads to a null pointer dereference. This commit addresses this issue by adding a proper guard to access the gamut_remap callback in case the specific ASIC did not implement this function.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在访问DCN401的DTN日志时存在空指针取消引用问题。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c ~ 1e68b7ce6bc6073579fe8713ec6b85aa9cd2e351	-
Linux	Linux	4.15	-

II. Public POCs for CVE-2024-43901

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2024-43901

请登录查看更多情报信息。

Other References for CVE-2024-43901 (2)

https://www.cve.org/CVERecord?id=CVE-2024-43901

Same Patch Batch · Linux · 2024-08-26 · 39 CVEs total

CVE-2024-43897	7.8 HIGH	net: drop bad gso csum_start and offset in virtio_net_hdr
CVE-2024-43910	7.8 HIGH	bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses
CVE-2024-44934	7.8 HIGH	net: bridge: mcast: wait for previous gc cycles when removing port
CVE-2024-43892	7.8 HIGH	memcg: protect concurrent access to mem_cgroup_idr
CVE-2024-43891	7.8 HIGH	tracing: Have format file honor EVENT_FILE_FL_FREED
CVE-2024-44941	7.8 HIGH	f2fs: fix to cover read extent cache access with lock
CVE-2024-44942	7.8 HIGH	f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
CVE-2024-44939	7.8 HIGH	jfs: fix null ptr deref in dtInsertEntry
CVE-2024-43888	7.8 HIGH	mm: list_lru: fix UAF for memory cgroup
CVE-2024-44940	7.5 HIGH	fou: remove warn in gue_gro_receive on unsupported protocol
CVE-2024-44933	7.3 HIGH	bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl()
CVE-2024-43913	7.0 HIGH	nvme: apple: fix device reference counting
CVE-2024-44938		jfs: Fix shift-out-of-bounds in dbDiscardAG
CVE-2024-44937		platform/x86: intel-vbtn: Protect ACPI notify handler against recursion
CVE-2024-44936		power: supply: rt5033: Bring back i2c_set_clientdata
CVE-2024-43908		drm/amdgpu: Fix the null pointer dereference to ras_manager
CVE-2024-44935		sctp: Fix null-ptr-deref in reuseport_add_sock().
CVE-2024-44932		idpf: fix UAFs when destroying the queues
CVE-2024-44931		gpio: prevent potential speculation leaks in gpio_device_get_desc()
CVE-2024-43914		md/raid5: avoid BUG_ON() while continue reshape after reassembling

Showing top 20 of 39 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2024-43901

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-43901— drm/amd/display: Fix NULL pointer dereference for DTN log in DCN401

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 6

I. Basic Information for CVE-2024-43901

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2024-43901

III. Intelligence Information for CVE-2024-43901

Other References for CVE-2024-43901 (2)

Same Patch Batch · Linux · 2024-08-26 · 39 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2024-43901

Leave a comment