CVE-2024-57919

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-57919
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-57919.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-57919
Downstream
Related
Published
2025-01-19T11:52:39Z
Modified
2025-10-17T19:51:50.805167Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
drm/amd/display: fix divide error in DM plane scale calcs
Details

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: fix divide error in DM plane scale calcs

dmgetplanescale doesn't take into account plane scaled size equal to zero, leading to a kernel oops due to division by zero. Fix by setting out-scale size as zero when the dst size is zero, similar to what is done by drmcalcscale(). This issue started with the introduction of cursor ovelay mode that uses this function to assess cursor mode changes via dmcrtcgetcursor_mode() before checking plane state.

[Dec17 17:14] Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI [ +0.000018] CPU: 5 PID: 1660 Comm: surface-DP-1 Not tainted 6.10.0+ #231 [ +0.000007] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0131 01/30/2024 [ +0.000004] RIP: 0010:dmgetplanescale+0x3f/0x60 [amdgpu] [ +0.000553] Code: 44 0f b7 41 3a 44 0f b7 49 3e 83 e0 0f 48 0f a3 c2 73 21 69 41 28 e8 03 00 00 31 d2 41 f7 f1 31 d2 89 06 69 41 2c e8 03 00 00 <41> f7 f0 89 07 e9 d7 d8 7e e9 44 89 c8 45 89 c1 41 89 c0 eb d4 66 [ +0.000005] RSP: 0018:ffffa8df0de6b8a0 EFLAGS: 00010246 [ +0.000006] RAX: 00000000000003e8 RBX: ffff9ac65c1f6e00 RCX: ffff9ac65d055500 [ +0.000003] RDX: 0000000000000000 RSI: ffffa8df0de6b8b0 RDI: ffffa8df0de6b8b4 [ +0.000004] RBP: ffff9ac64e7a5800 R08: 0000000000000000 R09: 0000000000000a00 [ +0.000003] R10: 00000000000000ff R11: 0000000000000054 R12: ffff9ac6d0700010 [ +0.000003] R13: ffff9ac65d054f00 R14: ffff9ac65d055500 R15: ffff9ac64e7a60a0 [ +0.000004] FS: 00007f869ea00640(0000) GS:ffff9ac970080000(0000) knlGS:0000000000000000 [ +0.000004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000003] CR2: 000055ca701becd0 CR3: 000000010e7f2000 CR4: 0000000000350ef0 [ +0.000004] Call Trace: [ +0.000007] <TASK> [ +0.000006] ? _diebody.cold+0x19/0x27 [ +0.000009] ? die+0x2e/0x50 [ +0.000007] ? dotrap+0xca/0x110 [ +0.000007] ? doerrortrap+0x6a/0x90 [ +0.000006] ? dmgetplanescale+0x3f/0x60 [amdgpu] [ +0.000504] ? excdivideerror+0x38/0x50 [ +0.000005] ? dmgetplanescale+0x3f/0x60 [amdgpu] [ +0.000488] ? asmexcdivideerror+0x1a/0x20 [ +0.000011] ? dmgetplanescale+0x3f/0x60 [amdgpu] [ +0.000593] dmcrtcgetcursormode+0x33f/0x430 [amdgpu] [ +0.000562] amdgpudmatomiccheck+0x2ef/0x1770 [amdgpu] [ +0.000501] drmatomiccheckonly+0x5e1/0xa30 [drm] [ +0.000047] drmmodeatomicioctl+0x832/0xcb0 [drm] [ +0.000050] ? _pfxdrmmodeatomicioctl+0x10/0x10 [drm] [ +0.000047] drmioctlkernel+0xb3/0x100 [drm] [ +0.000062] drmioctl+0x27a/0x4f0 [drm] [ +0.000049] ? _pfxdrmmodeatomicioctl+0x10/0x10 [drm] [ +0.000055] amdgpudrmioctl+0x4e/0x90 [amdgpu] [ +0.000360] _x64sysioctl+0x97/0xd0 [ +0.000010] dosyscall64+0x82/0x190 [ +0.000008] ? _pfxdrmmodecreateblobioctl+0x10/0x10 [drm] [ +0.000044] ? srsoreturnthunk+0x5/0x5f [ +0.000006] ? drmioctlkernel+0xb3/0x100 [drm] [ +0.000040] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? _checkobjectsize+0x50/0x220 [ +0.000007] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? drmioctl+0x2a4/0x4f0 [drm] [ +0.000039] ? _pfxdrmmodecreateblobioctl+0x10/0x10 [drm] [ +0.000043] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? _pmruntimesuspend+0x69/0xc0 [ +0.000006] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? amdgpudrmioctl+0x71/0x90 [amdgpu] [ +0.000366] ? srsoreturnthunk+0x5/0x5f [ +0.000006] ? syscallexittousermode+0x77/0x210 [ +0.000007] ? srsoreturnthunk+0x5/0x5f [ +0.000005] ? dosyscall64+0x8e/0x190 [ +0.000006] ? srsoreturnthunk+0x5/0x5f [ +0.000006] ? dosyscall64+0x8e/0x190 [ +0.000006] ? srsoreturnthunk+0x5/0x5f [ +0.000007] entrySYSCALL64afterhwframe+0x76/0x7e [ +0.000008] RIP: 0033:0x55bb7cd962bc [ +0.000007] Code: 4c 89 6c 24 18 4c 89 64 24 20 4c 89 74 24 28 0f 57 c0 0f 11 44 24 30 89 c7 48 8d 54 24 08 b8 10 00 00 00 be bc 64 ---truncated---

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
1b04dcca4fb10dd3834893a60de74edd99f2bfaf
Fixed
c2eaa73bd542b0168a0519e4a1c6e94bc121ec3d
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
1b04dcca4fb10dd3834893a60de74edd99f2bfaf
Fixed
5225fd2a26211d012533acf98a6ad3f983885817

Affected versions

v6.*

v6.10
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.11
v6.11-rc1
v6.11-rc2
v6.11-rc3
v6.11-rc4
v6.11-rc5
v6.11-rc6
v6.11-rc7
v6.12
v6.12-rc1
v6.12-rc2
v6.12-rc3
v6.12-rc4
v6.12-rc5
v6.12-rc6
v6.12-rc7
v6.12.1
v6.12.2
v6.12.3
v6.12.4
v6.12.5
v6.12.6
v6.12.7
v6.12.8
v6.12.9
v6.13-rc1
v6.13-rc2
v6.13-rc3
v6.13-rc4
v6.13-rc5
v6.9
v6.9-rc6
v6.9-rc7

Database specific

vanir_signatures

[
    {
        "signature_type": "Function",
        "id": "CVE-2024-57919-74a02211",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c2eaa73bd542b0168a0519e4a1c6e94bc121ec3d",
        "signature_version": "v1",
        "target": {
            "function": "dm_get_plane_scale",
            "file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"
        },
        "digest": {
            "function_hash": "269968928203455033426077583795791893970",
            "length": 212.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "id": "CVE-2024-57919-90ec0871",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5225fd2a26211d012533acf98a6ad3f983885817",
        "signature_version": "v1",
        "target": {
            "file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "122146570193595971796948928744862260519",
                "303160258134561964277253054696005219644",
                "89847302378303404026479904909417654071",
                "43461972038391768071012234834936001491",
                "282015701741802288071313404472988465504"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "id": "CVE-2024-57919-9a1c2876",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5225fd2a26211d012533acf98a6ad3f983885817",
        "signature_version": "v1",
        "target": {
            "function": "dm_get_plane_scale",
            "file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"
        },
        "digest": {
            "function_hash": "269968928203455033426077583795791893970",
            "length": 212.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "id": "CVE-2024-57919-d5a88286",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c2eaa73bd542b0168a0519e4a1c6e94bc121ec3d",
        "signature_version": "v1",
        "target": {
            "file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "122146570193595971796948928744862260519",
                "303160258134561964277253054696005219644",
                "89847302378303404026479904909417654071",
                "43461972038391768071012234834936001491",
                "282015701741802288071313404472988465504"
            ]
        },
        "deprecated": false
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.11.0
Fixed
6.12.10