GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-47720 (GCVE-0-2024-47720)

Vulnerability from cvelistv5 – Published: 2024-10-21 11:53 – Updated: 2026-05-11 20:39
VLAI
Title
drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func This commit adds a null check for the set_output_gamma function pointer in the dcn30_set_output_transfer_func function. Previously, set_output_gamma was being checked for nullity at line 386, but then it was being dereferenced without any nullity check at line 401. This could potentially lead to a null pointer dereference error if set_output_gamma is indeed null. To fix this, we now ensure that set_output_gamma is not null before dereferencing it. We do this by adding a nullity check for set_output_gamma before the call to set_output_gamma at line 401. If set_output_gamma is null, we log an error message and do not call the function. This fix prevents a potential null pointer dereference error. drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401 dcn30_set_output_transfer_func() error: we previously assumed 'mpc->funcs->set_output_gamma' could be null (see line 386) drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c 373 bool dcn30_set_output_transfer_func(struct dc *dc, 374 struct pipe_ctx *pipe_ctx, 375 const struct dc_stream_state *stream) 376 { 377 int mpcc_id = pipe_ctx->plane_res.hubp->inst; 378 struct mpc *mpc = pipe_ctx->stream_res.opp->ctx->dc->res_pool->mpc; 379 const struct pwl_params *params = NULL; 380 bool ret = false; 381 382 /* program OGAM or 3DLUT only for the top pipe*/ 383 if (pipe_ctx->top_pipe == NULL) { 384 /*program rmu shaper and 3dlut in MPC*/ 385 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream); 386 if (ret == false && mpc->funcs->set_output_gamma) { ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If this is NULL 387 if (stream->out_transfer_func.type == TF_TYPE_HWPWL) 388 params = &stream->out_transfer_func.pwl; 389 else if (pipe_ctx->stream->out_transfer_func.type == 390 TF_TYPE_DISTRIBUTED_POINTS && 391 cm3_helper_translate_curve_to_hw_format( 392 &stream->out_transfer_func, 393 &mpc->blender_params, false)) 394 params = &mpc->blender_params; 395 /* there are no ROM LUTs in OUTGAM */ 396 if (stream->out_transfer_func.type == TF_TYPE_PREDEFINED) 397 BREAK_TO_DEBUGGER(); 398 } 399 } 400 --> 401 mpc->funcs->set_output_gamma(mpc, mpcc_id, params); ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Then it will crash 402 return ret; 403 }
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 13:02 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d99f13878d6f9c286b13860d8bf0b4db9ffb189a , < 44948d3cb943602ba4a0b5ed3c91ae0525838fb1 (git)
Affected: d99f13878d6f9c286b13860d8bf0b4db9ffb189a , < 64886a4e6f1dce843c0889505cf0673b5211e16a (git)
Affected: d99f13878d6f9c286b13860d8bf0b4db9ffb189a , < ddf9ff244d704e1903533f7be377615ed34b83e7 (git)
Affected: d99f13878d6f9c286b13860d8bf0b4db9ffb189a , < 84edd5a3f5fa6aafa4afcaf9f101f46426c620c9 (git)
Affected: d99f13878d6f9c286b13860d8bf0b4db9ffb189a , < 72ee32d0907364104fbcf4f68dd5ae63cd8eae9e (git)
Affected: d99f13878d6f9c286b13860d8bf0b4db9ffb189a , < 08ae395ea22fb3d9b318c8bde28c0dfd2f5fa4d2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.9
Unaffected: 0 , < 5.9 (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.54 , ≤ 6.6.* (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47720",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:02:07.747616Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:17.600Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:21:20.641Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "44948d3cb943602ba4a0b5ed3c91ae0525838fb1",
              "status": "affected",
              "version": "d99f13878d6f9c286b13860d8bf0b4db9ffb189a",
              "versionType": "git"
            },
            {
              "lessThan": "64886a4e6f1dce843c0889505cf0673b5211e16a",
              "status": "affected",
              "version": "d99f13878d6f9c286b13860d8bf0b4db9ffb189a",
              "versionType": "git"
            },
            {
              "lessThan": "ddf9ff244d704e1903533f7be377615ed34b83e7",
              "status": "affected",
              "version": "d99f13878d6f9c286b13860d8bf0b4db9ffb189a",
              "versionType": "git"
            },
            {
              "lessThan": "84edd5a3f5fa6aafa4afcaf9f101f46426c620c9",
              "status": "affected",
              "version": "d99f13878d6f9c286b13860d8bf0b4db9ffb189a",
              "versionType": "git"
            },
            {
              "lessThan": "72ee32d0907364104fbcf4f68dd5ae63cd8eae9e",
              "status": "affected",
              "version": "d99f13878d6f9c286b13860d8bf0b4db9ffb189a",
              "versionType": "git"
            },
            {
              "lessThan": "08ae395ea22fb3d9b318c8bde28c0dfd2f5fa4d2",
              "status": "affected",
              "version": "d99f13878d6f9c286b13860d8bf0b4db9ffb189a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func\n\nThis commit adds a null check for the set_output_gamma function pointer\nin the  dcn30_set_output_transfer_func function. Previously,\nset_output_gamma was being checked for nullity at line 386, but then it\nwas being dereferenced without any nullity check at line 401. This\ncould potentially lead to a null pointer dereference error if\nset_output_gamma is indeed null.\n\nTo fix this, we now ensure that set_output_gamma is not null before\ndereferencing it. We do this by adding a nullity check for\nset_output_gamma before the call to set_output_gamma at line 401. If\nset_output_gamma is null, we log an error message and do not call the\nfunction.\n\nThis fix prevents a potential null pointer dereference error.\n\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401 dcn30_set_output_transfer_func()\nerror: we previously assumed \u0027mpc-\u003efuncs-\u003eset_output_gamma\u0027 could be null (see line 386)\n\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c\n    373 bool dcn30_set_output_transfer_func(struct dc *dc,\n    374                                 struct pipe_ctx *pipe_ctx,\n    375                                 const struct dc_stream_state *stream)\n    376 {\n    377         int mpcc_id = pipe_ctx-\u003eplane_res.hubp-\u003einst;\n    378         struct mpc *mpc = pipe_ctx-\u003estream_res.opp-\u003ectx-\u003edc-\u003eres_pool-\u003empc;\n    379         const struct pwl_params *params = NULL;\n    380         bool ret = false;\n    381\n    382         /* program OGAM or 3DLUT only for the top pipe*/\n    383         if (pipe_ctx-\u003etop_pipe == NULL) {\n    384                 /*program rmu shaper and 3dlut in MPC*/\n    385                 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream);\n    386                 if (ret == false \u0026\u0026 mpc-\u003efuncs-\u003eset_output_gamma) {\n                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If this is NULL\n\n    387                         if (stream-\u003eout_transfer_func.type == TF_TYPE_HWPWL)\n    388                                 params = \u0026stream-\u003eout_transfer_func.pwl;\n    389                         else if (pipe_ctx-\u003estream-\u003eout_transfer_func.type ==\n    390                                         TF_TYPE_DISTRIBUTED_POINTS \u0026\u0026\n    391                                         cm3_helper_translate_curve_to_hw_format(\n    392                                         \u0026stream-\u003eout_transfer_func,\n    393                                         \u0026mpc-\u003eblender_params, false))\n    394                                 params = \u0026mpc-\u003eblender_params;\n    395                          /* there are no ROM LUTs in OUTGAM */\n    396                         if (stream-\u003eout_transfer_func.type == TF_TYPE_PREDEFINED)\n    397                                 BREAK_TO_DEBUGGER();\n    398                 }\n    399         }\n    400\n--\u003e 401         mpc-\u003efuncs-\u003eset_output_gamma(mpc, mpcc_id, params);\n                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Then it will crash\n\n    402         return ret;\n    403 }"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:39:28.989Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/44948d3cb943602ba4a0b5ed3c91ae0525838fb1"
        },
        {
          "url": "https://git.kernel.org/stable/c/64886a4e6f1dce843c0889505cf0673b5211e16a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddf9ff244d704e1903533f7be377615ed34b83e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/84edd5a3f5fa6aafa4afcaf9f101f46426c620c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/72ee32d0907364104fbcf4f68dd5ae63cd8eae9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/08ae395ea22fb3d9b318c8bde28c0dfd2f5fa4d2"
        }
      ],
      "title": "drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47720",
    "datePublished": "2024-10-21T11:53:50.178Z",
    "dateReserved": "2024-09-30T16:00:12.950Z",
    "dateUpdated": "2026-05-11T20:39:28.989Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47720",
      "date": "2026-09-16",
      "epss": "0.0022",
      "percentile": "0.12589"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.9\", \"versionEndExcluding\": \"5.15.168\", \"matchCriteriaId\": \"643E292D-C242-4FEC-8A11-034AB46708C1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.113\", \"matchCriteriaId\": \"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.54\", \"matchCriteriaId\": \"D448821D-C085-4CAF-88FA-2DDE7BE21976\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.13\", \"matchCriteriaId\": \"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.2\", \"matchCriteriaId\": \"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func\\n\\nThis commit adds a null check for the set_output_gamma function pointer\\nin the  dcn30_set_output_transfer_func function. Previously,\\nset_output_gamma was being checked for nullity at line 386, but then it\\nwas being dereferenced without any nullity check at line 401. This\\ncould potentially lead to a null pointer dereference error if\\nset_output_gamma is indeed null.\\n\\nTo fix this, we now ensure that set_output_gamma is not null before\\ndereferencing it. We do this by adding a nullity check for\\nset_output_gamma before the call to set_output_gamma at line 401. If\\nset_output_gamma is null, we log an error message and do not call the\\nfunction.\\n\\nThis fix prevents a potential null pointer dereference error.\\n\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401 dcn30_set_output_transfer_func()\\nerror: we previously assumed \u0027mpc-\u003efuncs-\u003eset_output_gamma\u0027 could be null (see line 386)\\n\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c\\n    373 bool dcn30_set_output_transfer_func(struct dc *dc,\\n    374                                 struct pipe_ctx *pipe_ctx,\\n    375                                 const struct dc_stream_state *stream)\\n    376 {\\n    377         int mpcc_id = pipe_ctx-\u003eplane_res.hubp-\u003einst;\\n    378         struct mpc *mpc = pipe_ctx-\u003estream_res.opp-\u003ectx-\u003edc-\u003eres_pool-\u003empc;\\n    379         const struct pwl_params *params = NULL;\\n    380         bool ret = false;\\n    381\\n    382         /* program OGAM or 3DLUT only for the top pipe*/\\n    383         if (pipe_ctx-\u003etop_pipe == NULL) {\\n    384                 /*program rmu shaper and 3dlut in MPC*/\\n    385                 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream);\\n    386                 if (ret == false \u0026\u0026 mpc-\u003efuncs-\u003eset_output_gamma) {\\n                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If this is NULL\\n\\n    387                         if (stream-\u003eout_transfer_func.type == TF_TYPE_HWPWL)\\n    388                                 params = \u0026stream-\u003eout_transfer_func.pwl;\\n    389                         else if (pipe_ctx-\u003estream-\u003eout_transfer_func.type ==\\n    390                                         TF_TYPE_DISTRIBUTED_POINTS \u0026\u0026\\n    391                                         cm3_helper_translate_curve_to_hw_format(\\n    392                                         \u0026stream-\u003eout_transfer_func,\\n    393                                         \u0026mpc-\u003eblender_params, false))\\n    394                                 params = \u0026mpc-\u003eblender_params;\\n    395                          /* there are no ROM LUTs in OUTGAM */\\n    396                         if (stream-\u003eout_transfer_func.type == TF_TYPE_PREDEFINED)\\n    397                                 BREAK_TO_DEBUGGER();\\n    398                 }\\n    399         }\\n    400\\n--\u003e 401         mpc-\u003efuncs-\u003eset_output_gamma(mpc, mpcc_id, params);\\n                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Then it will crash\\n\\n    402         return ret;\\n    403 }\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/display: Agregar comprobaci\\u00f3n nula para set_output_gamma en dcn30_set_output_transfer_func Esta confirmaci\\u00f3n agrega una comprobaci\\u00f3n nula para el puntero de funci\\u00f3n set_output_gamma en la funci\\u00f3n dcn30_set_output_transfer_func. Anteriormente, se estaba comprobando la nulidad de set_output_gamma en la l\\u00ednea 386, pero luego se estaba desreferenciando sin ninguna comprobaci\\u00f3n de nulidad en la l\\u00ednea 401. Esto podr\\u00eda conducir potencialmente a un error de desreferencia de puntero nulo si set_output_gamma es de hecho nulo. Para solucionar esto, ahora nos aseguramos de que set_output_gamma no sea nulo antes de desreferenciarlo. Hacemos esto agregando una comprobaci\\u00f3n de nulidad para set_output_gamma antes de la llamada a set_output_gamma en la l\\u00ednea 401. Si set_output_gamma es nulo, registramos un mensaje de error y no llamamos a la funci\\u00f3n. Esta correcci\\u00f3n evita un posible error de desreferencia de puntero nulo. drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401 error de dcn30_set_output_transfer_func(): anteriormente asumimos que \u0027mpc-\u0026gt;funcs-\u0026gt;set_output_gamma\u0027 podr\\u00eda ser nulo (ver l\\u00ednea 386) drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c 373 bool dcn30_set_output_transfer_func(struct dc *dc, 374 struct pipe_ctx *pipe_ctx, 375 const struct dc_stream_state *stream) 376 { 377 int mpcc_id = pipe_ctx-\u0026gt;plane_res.hubp-\u0026gt;inst; 378 struct mpc *mpc = pipe_ctx-\u0026gt;stream_res.opp-\u0026gt;ctx-\u0026gt;dc-\u0026gt;res_pool-\u0026gt;mpc; 379 const struct pwl_params *params = NULL; 380 bool ret = false; 381 382 /* programa OGAM o 3DLUT solo para la tuber\\u00eda superior*/ 383 if (pipe_ctx-\u0026gt;top_pipe == NULL) { 384 /*programa rmu shaper y 3dlut en MPC*/ 385 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream); 386 si (ret == falso \u0026amp;\u0026amp; mpc-\u0026gt;funcs-\u0026gt;set_output_gamma) { ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Si esto es NULL 387 si (flujo-\u0026gt;out_transfer_func.type == TF_TYPE_HWPWL) 388 par\\u00e1metros = \u0026amp;flujo-\u0026gt;out_transfer_func.pwl; 389 de lo contrario si (pipe_ctx-\u0026gt;flujo-\u0026gt;out_transfer_func.type == 390 TF_TYPE_DISTRIBUTED_POINTS \u0026amp;\u0026amp; 391 cm3_helper_translate_curve_to_hw_format( 392 \u0026amp;flujo-\u0026gt;out_transfer_func, 393 \u0026amp;mpc-\u0026gt;blender_params, falso)) 394 par\\u00e1metros = \u0026amp;mpc-\u0026gt;blender_params; 395 /* no hay LUT de ROM en OUTGAM */ 396 if (stream-\u0026gt;out_transfer_func.type == TF_TYPE_PREDEFINED) 397 BREAK_TO_DEBUGGER(); 398 } 399 } 400 --\u0026gt; 401 mpc-\u0026gt;funcs-\u0026gt;set_output_gamma(mpc, mpcc_id, params); ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Entonces se bloquear\\u00e1 402 return ret; 403 }\"}]",
      "id": "CVE-2024-47720",
      "lastModified": "2024-10-23T20:53:54.150",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-10-21T12:15:08.240",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/08ae395ea22fb3d9b318c8bde28c0dfd2f5fa4d2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/44948d3cb943602ba4a0b5ed3c91ae0525838fb1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/64886a4e6f1dce843c0889505cf0673b5211e16a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/72ee32d0907364104fbcf4f68dd5ae63cd8eae9e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/84edd5a3f5fa6aafa4afcaf9f101f46426c620c9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ddf9ff244d704e1903533f7be377615ed34b83e7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:56:51.000Z",
      "cve": "CVE-2024-47720",
      "id": "msrc_CVE-2024-47720",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-47720.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47720\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T12:15:08.240\",\"lastModified\":\"2026-06-17T07:57:37.520\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func\\n\\nThis commit adds a null check for the set_output_gamma function pointer\\nin the  dcn30_set_output_transfer_func function. Previously,\\nset_output_gamma was being checked for nullity at line 386, but then it\\nwas being dereferenced without any nullity check at line 401. This\\ncould potentially lead to a null pointer dereference error if\\nset_output_gamma is indeed null.\\n\\nTo fix this, we now ensure that set_output_gamma is not null before\\ndereferencing it. We do this by adding a nullity check for\\nset_output_gamma before the call to set_output_gamma at line 401. If\\nset_output_gamma is null, we log an error message and do not call the\\nfunction.\\n\\nThis fix prevents a potential null pointer dereference error.\\n\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401 dcn30_set_output_transfer_func()\\nerror: we previously assumed \u0027mpc-\u003efuncs-\u003eset_output_gamma\u0027 could be null (see line 386)\\n\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c\\n    373 bool dcn30_set_output_transfer_func(struct dc *dc,\\n    374                                 struct pipe_ctx *pipe_ctx,\\n    375                                 const struct dc_stream_state *stream)\\n    376 {\\n    377         int mpcc_id = pipe_ctx-\u003eplane_res.hubp-\u003einst;\\n    378         struct mpc *mpc = pipe_ctx-\u003estream_res.opp-\u003ectx-\u003edc-\u003eres_pool-\u003empc;\\n    379         const struct pwl_params *params = NULL;\\n    380         bool ret = false;\\n    381\\n    382         /* program OGAM or 3DLUT only for the top pipe*/\\n    383         if (pipe_ctx-\u003etop_pipe == NULL) {\\n    384                 /*program rmu shaper and 3dlut in MPC*/\\n    385                 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream);\\n    386                 if (ret == false \u0026\u0026 mpc-\u003efuncs-\u003eset_output_gamma) {\\n                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If this is NULL\\n\\n    387                         if (stream-\u003eout_transfer_func.type == TF_TYPE_HWPWL)\\n    388                                 params = \u0026stream-\u003eout_transfer_func.pwl;\\n    389                         else if (pipe_ctx-\u003estream-\u003eout_transfer_func.type ==\\n    390                                         TF_TYPE_DISTRIBUTED_POINTS \u0026\u0026\\n    391                                         cm3_helper_translate_curve_to_hw_format(\\n    392                                         \u0026stream-\u003eout_transfer_func,\\n    393                                         \u0026mpc-\u003eblender_params, false))\\n    394                                 params = \u0026mpc-\u003eblender_params;\\n    395                          /* there are no ROM LUTs in OUTGAM */\\n    396                         if (stream-\u003eout_transfer_func.type == TF_TYPE_PREDEFINED)\\n    397                                 BREAK_TO_DEBUGGER();\\n    398                 }\\n    399         }\\n    400\\n--\u003e 401         mpc-\u003efuncs-\u003eset_output_gamma(mpc, mpcc_id, params);\\n                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Then it will crash\\n\\n    402         return ret;\\n    403 }\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/display: Agregar comprobaci\u00f3n nula para set_output_gamma en dcn30_set_output_transfer_func Esta confirmaci\u00f3n agrega una comprobaci\u00f3n nula para el puntero de funci\u00f3n set_output_gamma en la funci\u00f3n dcn30_set_output_transfer_func. Anteriormente, se estaba comprobando la nulidad de set_output_gamma en la l\u00ednea 386, pero luego se estaba desreferenciando sin ninguna comprobaci\u00f3n de nulidad en la l\u00ednea 401. Esto podr\u00eda conducir potencialmente a un error de desreferencia de puntero nulo si set_output_gamma es de hecho nulo. Para solucionar esto, ahora nos aseguramos de que set_output_gamma no sea nulo antes de desreferenciarlo. Hacemos esto agregando una comprobaci\u00f3n de nulidad para set_output_gamma antes de la llamada a set_output_gamma en la l\u00ednea 401. Si set_output_gamma es nulo, registramos un mensaje de error y no llamamos a la funci\u00f3n. Esta correcci\u00f3n evita un posible error de desreferencia de puntero nulo. drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401 error de dcn30_set_output_transfer_func(): anteriormente asumimos que \u0027mpc-\u0026gt;funcs-\u0026gt;set_output_gamma\u0027 podr\u00eda ser nulo (ver l\u00ednea 386) drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c 373 bool dcn30_set_output_transfer_func(struct dc *dc, 374 struct pipe_ctx *pipe_ctx, 375 const struct dc_stream_state *stream) 376 { 377 int mpcc_id = pipe_ctx-\u0026gt;plane_res.hubp-\u0026gt;inst; 378 struct mpc *mpc = pipe_ctx-\u0026gt;stream_res.opp-\u0026gt;ctx-\u0026gt;dc-\u0026gt;res_pool-\u0026gt;mpc; 379 const struct pwl_params *params = NULL; 380 bool ret = false; 381 382 /* programa OGAM o 3DLUT solo para la tuber\u00eda superior*/ 383 if (pipe_ctx-\u0026gt;top_pipe == NULL) { 384 /*programa rmu shaper y 3dlut en MPC*/ 385 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream); 386 si (ret == falso \u0026amp;\u0026amp; mpc-\u0026gt;funcs-\u0026gt;set_output_gamma) { ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Si esto es NULL 387 si (flujo-\u0026gt;out_transfer_func.type == TF_TYPE_HWPWL) 388 par\u00e1metros = \u0026amp;flujo-\u0026gt;out_transfer_func.pwl; 389 de lo contrario si (pipe_ctx-\u0026gt;flujo-\u0026gt;out_transfer_func.type == 390 TF_TYPE_DISTRIBUTED_POINTS \u0026amp;\u0026amp; 391 cm3_helper_translate_curve_to_hw_format( 392 \u0026amp;flujo-\u0026gt;out_transfer_func, 393 \u0026amp;mpc-\u0026gt;blender_params, falso)) 394 par\u00e1metros = \u0026amp;mpc-\u0026gt;blender_params; 395 /* no hay LUT de ROM en OUTGAM */ 396 if (stream-\u0026gt;out_transfer_func.type == TF_TYPE_PREDEFINED) 397 BREAK_TO_DEBUGGER(); 398 } 399 } 400 --\u0026gt; 401 mpc-\u0026gt;funcs-\u0026gt;set_output_gamma(mpc, mpcc_id, params); ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Entonces se bloquear\u00e1 402 return ret; 403 }\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d99f13878d6f9c286b13860d8bf0b4db9ffb189a\",\"lessThan\":\"44948d3cb943602ba4a0b5ed3c91ae0525838fb1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d99f13878d6f9c286b13860d8bf0b4db9ffb189a\",\"lessThan\":\"64886a4e6f1dce843c0889505cf0673b5211e16a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d99f13878d6f9c286b13860d8bf0b4db9ffb189a\",\"lessThan\":\"ddf9ff244d704e1903533f7be377615ed34b83e7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d99f13878d6f9c286b13860d8bf0b4db9ffb189a\",\"lessThan\":\"84edd5a3f5fa6aafa4afcaf9f101f46426c620c9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d99f13878d6f9c286b13860d8bf0b4db9ffb189a\",\"lessThan\":\"72ee32d0907364104fbcf4f68dd5ae63cd8eae9e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d99f13878d6f9c286b13860d8bf0b4db9ffb189a\",\"lessThan\":\"08ae395ea22fb3d9b318c8bde28c0dfd2f5fa4d2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.168\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.113\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.54\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.13\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.2\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-21T13:02:07.747616Z\",\"id\":\"CVE-2024-47720\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.9\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"643E292D-C242-4FEC-8A11-034AB46708C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.54\",\"matchCriteriaId\":\"D448821D-C085-4CAF-88FA-2DDE7BE21976\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.13\",\"matchCriteriaId\":\"CE94BB8D-B0AB-4563-9ED7-A12122B56EBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/08ae395ea22fb3d9b318c8bde28c0dfd2f5fa4d2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/44948d3cb943602ba4a0b5ed3c91ae0525838fb1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/64886a4e6f1dce843c0889505cf0673b5211e16a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/72ee32d0907364104fbcf4f68dd5ae63cd8eae9e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/84edd5a3f5fa6aafa4afcaf9f101f46426c620c9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ddf9ff244d704e1903533f7be377615ed34b83e7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T14:22:03+00:00",
      "cve": "CVE-2024-47720",
      "id": "CVE-2024-47720",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47720.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:52:35Z",
      "cve": "CVE-2024-47720",
      "id": "CVE-2024-47720",
      "initial_release_date": "2024-10-21T15:46:56Z",
      "product_status:known_affected": "361",
      "product_status:known_not_affected": "269",
      "product_status:recommended": "638",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-47720",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-47720.json",
      "version": "92"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47720\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T13:02:07.747616Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T13:02:10.851Z\"}}], \"cna\": {\"title\": \"drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d99f13878d6f9c286b13860d8bf0b4db9ffb189a\", \"lessThan\": \"44948d3cb943602ba4a0b5ed3c91ae0525838fb1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d99f13878d6f9c286b13860d8bf0b4db9ffb189a\", \"lessThan\": \"64886a4e6f1dce843c0889505cf0673b5211e16a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d99f13878d6f9c286b13860d8bf0b4db9ffb189a\", \"lessThan\": \"ddf9ff244d704e1903533f7be377615ed34b83e7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d99f13878d6f9c286b13860d8bf0b4db9ffb189a\", \"lessThan\": \"84edd5a3f5fa6aafa4afcaf9f101f46426c620c9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d99f13878d6f9c286b13860d8bf0b4db9ffb189a\", \"lessThan\": \"72ee32d0907364104fbcf4f68dd5ae63cd8eae9e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d99f13878d6f9c286b13860d8bf0b4db9ffb189a\", \"lessThan\": \"08ae395ea22fb3d9b318c8bde28c0dfd2f5fa4d2\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/amd/display/dc/hwss/dcn30/dcn30_hwseq.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/44948d3cb943602ba4a0b5ed3c91ae0525838fb1\"}, {\"url\": \"https://git.kernel.org/stable/c/64886a4e6f1dce843c0889505cf0673b5211e16a\"}, {\"url\": \"https://git.kernel.org/stable/c/ddf9ff244d704e1903533f7be377615ed34b83e7\"}, {\"url\": \"https://git.kernel.org/stable/c/84edd5a3f5fa6aafa4afcaf9f101f46426c620c9\"}, {\"url\": \"https://git.kernel.org/stable/c/72ee32d0907364104fbcf4f68dd5ae63cd8eae9e\"}, {\"url\": \"https://git.kernel.org/stable/c/08ae395ea22fb3d9b318c8bde28c0dfd2f5fa4d2\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func\\n\\nThis commit adds a null check for the set_output_gamma function pointer\\nin the  dcn30_set_output_transfer_func function. Previously,\\nset_output_gamma was being checked for nullity at line 386, but then it\\nwas being dereferenced without any nullity check at line 401. This\\ncould potentially lead to a null pointer dereference error if\\nset_output_gamma is indeed null.\\n\\nTo fix this, we now ensure that set_output_gamma is not null before\\ndereferencing it. We do this by adding a nullity check for\\nset_output_gamma before the call to set_output_gamma at line 401. If\\nset_output_gamma is null, we log an error message and do not call the\\nfunction.\\n\\nThis fix prevents a potential null pointer dereference error.\\n\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401 dcn30_set_output_transfer_func()\\nerror: we previously assumed \u0027mpc-\u003efuncs-\u003eset_output_gamma\u0027 could be null (see line 386)\\n\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c\\n    373 bool dcn30_set_output_transfer_func(struct dc *dc,\\n    374                                 struct pipe_ctx *pipe_ctx,\\n    375                                 const struct dc_stream_state *stream)\\n    376 {\\n    377         int mpcc_id = pipe_ctx-\u003eplane_res.hubp-\u003einst;\\n    378         struct mpc *mpc = pipe_ctx-\u003estream_res.opp-\u003ectx-\u003edc-\u003eres_pool-\u003empc;\\n    379         const struct pwl_params *params = NULL;\\n    380         bool ret = false;\\n    381\\n    382         /* program OGAM or 3DLUT only for the top pipe*/\\n    383         if (pipe_ctx-\u003etop_pipe == NULL) {\\n    384                 /*program rmu shaper and 3dlut in MPC*/\\n    385                 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream);\\n    386                 if (ret == false \u0026\u0026 mpc-\u003efuncs-\u003eset_output_gamma) {\\n                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If this is NULL\\n\\n    387                         if (stream-\u003eout_transfer_func.type == TF_TYPE_HWPWL)\\n    388                                 params = \u0026stream-\u003eout_transfer_func.pwl;\\n    389                         else if (pipe_ctx-\u003estream-\u003eout_transfer_func.type ==\\n    390                                         TF_TYPE_DISTRIBUTED_POINTS \u0026\u0026\\n    391                                         cm3_helper_translate_curve_to_hw_format(\\n    392                                         \u0026stream-\u003eout_transfer_func,\\n    393                                         \u0026mpc-\u003eblender_params, false))\\n    394                                 params = \u0026mpc-\u003eblender_params;\\n    395                          /* there are no ROM LUTs in OUTGAM */\\n    396                         if (stream-\u003eout_transfer_func.type == TF_TYPE_PREDEFINED)\\n    397                                 BREAK_TO_DEBUGGER();\\n    398                 }\\n    399         }\\n    400\\n--\u003e 401         mpc-\u003efuncs-\u003eset_output_gamma(mpc, mpcc_id, params);\\n                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Then it will crash\\n\\n    402         return ret;\\n    403 }\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.54\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"5.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:38:15.217Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47720\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:38:15.217Z\", \"dateReserved\": \"2024-09-30T16:00:12.950Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T11:53:50.178Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.