From bippy-c9c4e1df01b2 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman To: Reply-to: , Subject: CVE-2022-48843: drm/vrr: Set VRR capable prop only if it is attached to connector Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/vrr: Set VRR capable prop only if it is attached to connector VRR capable property is not attached by default to the connector It is attached only if VRR is supported. So if the driver tries to call drm core set prop function without it being attached that causes NULL dereference. The Linux kernel CVE team has assigned CVE-2022-48843 to this issue. Affected and fixed versions =========================== Fixed in 5.4.186 with commit 941e8bcd2b2b Fixed in 5.10.107 with commit 0ba557d33094 Fixed in 5.15.30 with commit 3534c5c005ef Fixed in 5.16.16 with commit 85271e92ae4f Fixed in 5.17 with commit 62929726ef0e Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-48843 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/drm_connector.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/941e8bcd2b2ba95490738e33dfeca27168452779 https://git.kernel.org/stable/c/0ba557d330946c23559aaea2d51ea649fdeca98a https://git.kernel.org/stable/c/3534c5c005ef99a1804ed50b8a72cdae254cabb5 https://git.kernel.org/stable/c/85271e92ae4f13aa679acaa6cf76b3c36bcb7bab https://git.kernel.org/stable/c/62929726ef0ec72cbbe9440c5d125d4278b99894