Executive brief
The AMD display driver in the Linux kernel contained a potential null pointer dereference in the dm_resume() function, which handles resuming display functionality after system suspend. If a display connector lacked a valid DC link object, the system could crash or hang during resume, affecting availability on systems with AMD graphics hardware.
Technical details
This is a null pointer dereference vulnerability in the AMD display driver's dm_resume() function. The vulnerability occurs when iterating through display connectors during system resume: the code was dereferencing aconnector->dc_link without consistently checking for null, despite earlier logic that assumed it could be null. An attacker with local access could trigger a system resume (e.g., via lid-close/open on a laptop or explicit suspend/resume) with a crafted display configuration to cause a null pointer dereference, resulting in a kernel crash (DoS). The fix adds an explicit null check for dc_link at the loop start, allowing early continuation and eliminating subsequent unsafe dereferences. This was patched in December 2022 across Linux stable branches.
Affected products
- Linux Linux kernel Affected versions across stable tree branches
Timeline
- 2022-12: disclosed: Vulnerability fixed by Roman Li in Linux kernel
- 2023-03-10: patched: Fix included in stable kernel releases via commit 00b655fa96b4e941351cc4bf5ca755a65ae94a8e