CVE-2024-50037

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/fbdev-dma: Only cleanup deferred I/O if necessary

Commit 5a498d4d06d6 ("drm/fbdev-dma: Only install deferred I/O if

necessary") initializes deferred I/O only if it is used.

drm_fbdev_dma_fb_destroy() however calls fb_deferred_io_cleanup()

unconditionally with struct fb_info.fbdefio == NULL. KASAN with the

out-of-tree Apple silicon display driver posts following warning from

__flush_work() of a random struct work_struct instead of the expected

NULL pointer derefs.

[ 22.053799] ------------[ cut here ]------------

[ 22.054832] WARNING: CPU: 2 PID: 1 at kernel/workqueue.c:4177 __flush_work+0x4d8/0x580

[ 22.056597] Modules linked in: uhid bnep uinput nls_ascii ip6_tables ip_tables i2c_dev loop fuse dm_multipath nfnetlink zram hid_magicmouse btrfs xor xor_neon brcmfmac_wcc raid6_pq hci_bcm4377 bluetooth brcmfmac hid_apple brcmutil nvmem_spmi_mfd simple_mfd_spmi dockchannel_hid cfg80211 joydev regmap_spmi nvme_a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References