{"timestamp":"2024-04-02T15:55:06.193007Z","id":"CVE-2024-26672","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","lessThan":"7b5d58c07024516c0e81b95e98f37710cf402c53","versionType":"git","status":"affected"},{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","lessThan":"4f32504a2f85a7b40fe149436881381f48e9c0c0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.2","status":"affected"},{"version":"0","lessThan":"4.2","versionType":"semver","status":"unaffected"},{"version":"6.7.4","lessThanOrEqual":"6.7.*","versionType":"semver","status":"unaffected"},{"version":"6.8","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

CWE-476

OR
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 6.7.4

CVE: https://git.kernel.org/stable/c/4f32504a2f85a7b40fe149436881381f48e9c0c0 Types: Patch

CVE: https://git.kernel.org/stable/c/7b5d58c07024516c0e81b95e98f37710cf402c53 Types: Patch

kernel.org: https://git.kernel.org/stable/c/4f32504a2f85a7b40fe149436881381f48e9c0c0 Types: Patch

kernel.org: https://git.kernel.org/stable/c/7b5d58c07024516c0e81b95e98f37710cf402c53 Types: Patch

https://git.kernel.org/stable/c/4f32504a2f85a7b40fe149436881381f48e9c0c0

https://git.kernel.org/stable/c/7b5d58c07024516c0e81b95e98f37710cf402c53

CISA-ADP AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()'

Fixes the below:

drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c:377 amdgpu_mca_smu_get_mca_entry() warn: variable dereferenced before check 'mca_funcs' (see line 368)

357 int amdgpu_mca_smu_get_mca_entry(struct amdgpu_device *adev,
				     enum amdgpu_mca_error_type type,
358                                  int idx, struct mca_bank_entry *entry)
359 {
360         const struct amdgpu_mca_smu_funcs *mca_funcs =
						adev->mca.mca_funcs;
361         int count;
362
363         switch (type) {
364         case AMDGPU_MCA_ERROR_TYPE_UE:
365                 count = mca_funcs->max_ue_count;

mca_funcs is dereferenced here.

366                 break;
367         case AMDGPU_MCA_ERROR_TYPE_CE:
368                 count = mca_funcs->max_ce_count;

mca_funcs is dereferenced here.

369                 break;
370         default:
371                 return -EINVAL;
372         }
373
374         if (idx >= count)
375                 return -EINVAL;
376
377         if (mca_funcs && mca_funcs->mca_get_mca_entry)
	        ^^^^^^^^^

Checked too late!

kernel.org https://git.kernel.org/stable/c/4f32504a2f85a7b40fe149436881381f48e9c0c0 [No types assigned]

kernel.org https://git.kernel.org/stable/c/7b5d58c07024516c0e81b95e98f37710cf402c53 [No types assigned]