cve-2024-44967
Vulnerability from cvelistv5
Published
2024-09-04 18:56
Modified
2024-12-19 09:19
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/mgag200: Bind I2C lifetime to DRM device Managed cleanup with devm_add_action_or_reset() will release the I2C adapter when the underlying Linux device goes away. But the connector still refers to it, so this cleanup leaves behind a stale pointer in struct drm_connector.ddc. Bind the lifetime of the I2C adapter to the connector's lifetime by using DRM's managed release. When the DRM device goes away (after the Linux device) DRM will first clean up the connector and then clean up the I2C adapter.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/55a6916db77102765b22855d3a0add4751988b7cPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/81d34df843620e902dd04aa9205c875833d61c17Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9d96b91e03cba9dfcb4ac370c93af4dbc47d5191Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/eb1ae34e48a09b7a1179c579aed042b032e408f4Patch
Impacted products
Vendor Product Version
Linux Linux Version: b279df242972ae816a75cf1cc732af836f999100
Version: b279df242972ae816a75cf1cc732af836f999100
Version: b279df242972ae816a75cf1cc732af836f999100
Version: b279df242972ae816a75cf1cc732af836f999100
 Create a notification for this product.
   Linux Linux Version: 6.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-44967",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-10T17:39:27.630336Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-12T17:33:35.025Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "drivers/gpu/drm/mgag200/mgag200_i2c.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "55a6916db77102765b22855d3a0add4751988b7c",
                     status: "affected",
                     version: "b279df242972ae816a75cf1cc732af836f999100",
                     versionType: "git",
                  },
                  {
                     lessThan: "81d34df843620e902dd04aa9205c875833d61c17",
                     status: "affected",
                     version: "b279df242972ae816a75cf1cc732af836f999100",
                     versionType: "git",
                  },
                  {
                     lessThan: "9d96b91e03cba9dfcb4ac370c93af4dbc47d5191",
                     status: "affected",
                     version: "b279df242972ae816a75cf1cc732af836f999100",
                     versionType: "git",
                  },
                  {
                     lessThan: "eb1ae34e48a09b7a1179c579aed042b032e408f4",
                     status: "affected",
                     version: "b279df242972ae816a75cf1cc732af836f999100",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "drivers/gpu/drm/mgag200/mgag200_i2c.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "6.0",
                  },
                  {
                     lessThan: "6.0",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.1.*",
                     status: "unaffected",
                     version: "6.1.105",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.6.*",
                     status: "unaffected",
                     version: "6.6.46",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.10.*",
                     status: "unaffected",
                     version: "6.10.5",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.11",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mgag200: Bind I2C lifetime to DRM device\n\nManaged cleanup with devm_add_action_or_reset() will release the I2C\nadapter when the underlying Linux device goes away. But the connector\nstill refers to it, so this cleanup leaves behind a stale pointer\nin struct drm_connector.ddc.\n\nBind the lifetime of the I2C adapter to the connector's lifetime by\nusing DRM's managed release. When the DRM device goes away (after\nthe Linux device) DRM will first clean up the connector and then\nclean up the I2C adapter.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-12-19T09:19:17.841Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/55a6916db77102765b22855d3a0add4751988b7c",
            },
            {
               url: "https://git.kernel.org/stable/c/81d34df843620e902dd04aa9205c875833d61c17",
            },
            {
               url: "https://git.kernel.org/stable/c/9d96b91e03cba9dfcb4ac370c93af4dbc47d5191",
            },
            {
               url: "https://git.kernel.org/stable/c/eb1ae34e48a09b7a1179c579aed042b032e408f4",
            },
         ],
         title: "drm/mgag200: Bind I2C lifetime to DRM device",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2024-44967",
      datePublished: "2024-09-04T18:56:44.814Z",
      dateReserved: "2024-08-21T05:34:56.667Z",
      dateUpdated: "2024-12-19T09:19:17.841Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-44967\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-04T19:15:31.117\",\"lastModified\":\"2024-10-03T18:21:17.230\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/mgag200: Bind I2C lifetime to DRM device\\n\\nManaged cleanup with devm_add_action_or_reset() will release the I2C\\nadapter when the underlying Linux device goes away. But the connector\\nstill refers to it, so this cleanup leaves behind a stale pointer\\nin struct drm_connector.ddc.\\n\\nBind the lifetime of the I2C adapter to the connector's lifetime by\\nusing DRM's managed release. When the DRM device goes away (after\\nthe Linux device) DRM will first clean up the connector and then\\nclean up the I2C adapter.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/mgag200: vincular la vida útil de I2C al dispositivo DRM La limpieza administrada con devm_add_action_or_reset() liberará el adaptador I2C cuando el dispositivo Linux subyacente desaparezca. Pero el conector aún hace referencia a él, por lo que esta limpieza deja un puntero obsoleto en struct drm_connector.ddc. Vincule la vida útil del adaptador I2C a la vida útil del conector mediante la liberación administrada de DRM. Cuando el dispositivo DRM desaparezca (después del dispositivo Linux), DRM primero limpiará el conector y luego limpiará el adaptador I2C.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0\",\"versionEndExcluding\":\"6.1.105\",\"matchCriteriaId\":\"C8F45861-5392-4CE3-B2F3-CAAF81C93350\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.46\",\"matchCriteriaId\":\"FA11941E-81FB-484C-B583-881EEB488340\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.5\",\"matchCriteriaId\":\"D074AE50-4A5E-499C-A2FD-75FD60DEA560\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/55a6916db77102765b22855d3a0add4751988b7c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/81d34df843620e902dd04aa9205c875833d61c17\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9d96b91e03cba9dfcb4ac370c93af4dbc47d5191\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/eb1ae34e48a09b7a1179c579aed042b032e408f4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-44967\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:39:27.630336Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:27.508Z\"}}], \"cna\": {\"title\": \"drm/mgag200: Bind I2C lifetime to DRM device\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b279df242972\", \"lessThan\": \"55a6916db771\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b279df242972\", \"lessThan\": \"81d34df84362\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b279df242972\", \"lessThan\": \"9d96b91e03cb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b279df242972\", \"lessThan\": \"eb1ae34e48a0\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/mgag200/mgag200_i2c.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.105\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.46\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/mgag200/mgag200_i2c.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/55a6916db77102765b22855d3a0add4751988b7c\"}, {\"url\": \"https://git.kernel.org/stable/c/81d34df843620e902dd04aa9205c875833d61c17\"}, {\"url\": \"https://git.kernel.org/stable/c/9d96b91e03cba9dfcb4ac370c93af4dbc47d5191\"}, {\"url\": \"https://git.kernel.org/stable/c/eb1ae34e48a09b7a1179c579aed042b032e408f4\"}], \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/mgag200: Bind I2C lifetime to DRM device\\n\\nManaged cleanup with devm_add_action_or_reset() will release the I2C\\nadapter when the underlying Linux device goes away. But the connector\\nstill refers to it, so this cleanup leaves behind a stale pointer\\nin struct drm_connector.ddc.\\n\\nBind the lifetime of the I2C adapter to the connector's lifetime by\\nusing DRM's managed release. When the DRM device goes away (after\\nthe Linux device) DRM will first clean up the connector and then\\nclean up the I2C adapter.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-05T09:43:08.827Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-44967\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-05T09:43:08.827Z\", \"dateReserved\": \"2024-08-21T05:34:56.667Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-04T18:56:44.814Z\", \"assignerShortName\": \"Linux\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.