medium 5.5

CVE-2024-47720 json

drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func

published 2024-10-21 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-42639

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 12%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

This commit adds a null check for the set_output_gamma function pointer in the dcn30_set_output_transfer_func function. Previously, set_output_gamma was being checked for nullity at line 386, but then it was being dereferenced without any nullity check at line 401. This could potentially lead to a null pointer dereference error if set_output_gamma is indeed null.

To fix this, we now ensure that set_output_gamma is not null before dereferencing it. We do this by adding a nullity check for set_output_gamma before the call to set_output_gamma at line 401. If set_output_gamma is null, we log an error message and do not call the function.

This fix prevents a potential null pointer dereference error.

drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:401 dcn30_set_output_transfer_func() error: we previously assumed 'mpc->funcs->set_output_gamma' could be null (see line 386)

drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c 373 bool dcn30_set_output_transfer_func(struct dc *dc, 374 struct pipe_ctx *pipe_ctx, 375 const struct dc_stream_state *stream) 376 { 377 int mpcc_id = pipe_ctx->plane_res.hubp->inst; 378 struct mpc *mpc = pipe_ctx->stream_res.opp->ctx->dc->res_pool->mpc; 379 const struct pwl_params *params = NULL; 380 bool ret = false; 381 382 /* program OGAM or 3DLUT only for the top pipe*/ 383 if (pipe_ctx->top_pipe == NULL) { 384 /*program rmu shaper and 3dlut in MPC*/ 385 ret = dcn30_set_mpc_shaper_3dlut(pipe_ctx, stream); 386 if (ret == false && mpc->funcs->set_output_gamma) { ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If this is NULL

387 if (stream->out_transfer_func.type == TF_TYPE_HWPWL) 388 params = &stream->out_transfer_func.pwl; 389 else if (pipe_ctx->stream->out_transfer_func.type == 390 TF_TYPE_DISTRIBUTED_POINTS && 391 cm3_helper_translate_curve_to_hw_format( 392 &stream->out_transfer_func, 393 &mpc->blender_params, false)) 394 params = &mpc->blender_params; 395 /* there are no ROM LUTs in OUTGAM */ 396 if (stream->out_transfer_func.type == TF_TYPE_PREDEFINED) 397 BREAK_TO_DEBUGGER(); 398 } 399 } 400 --> 401 mpc->funcs->set_output_gamma(mpc, mpcc_id, params); ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Then it will crash

402 return ret; 403 }

Patch / fix

fixed in 1 distros 5 links 6

Linux Linux 5.15.168, 6.1.113, 6.6.54, 6.10.13, 6.11.2, 6.12

debian ubuntu suse opensuse azure linux

linux Debian 12 6.1.115-1
linux Debian 14, Debian 13 6.11.2-1

debian advisories DEBIAN-CVE-2024-47720

linux Ubuntu 22.04 LTS 5.15.0-127.137
linux Ubuntu 24.04 LTS 6.8.0-54.56
linux-aws Ubuntu 22.04 LTS 5.15.0-1073.79
linux-aws Ubuntu 24.04 LTS 6.8.0-1023.25
linux-gcp Ubuntu 22.04 LTS 5.15.0-1072.80
linux-gcp Ubuntu 24.04 LTS 6.8.0-1024.26
linux-gke Ubuntu 22.04 LTS 5.15.0-1070.76
linux-gke Ubuntu 24.04 LTS 6.8.0-1019.23

ubuntu advisories UBUNTU-CVE-2024-47720

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-source Linux Micro 6.1, Linux Micro 6.0 6.4.0-24.1
kernel-default Linux Micro 6.1, Linux Micro 6.0 6.4.0-24.1
kernel-kvmsmall Linux Micro 6.1, Linux Micro 6.0 6.4.0-24.1
kernel-default-base Linux Micro 6.1, Linux Micro 6.0 6.4.0-24.1.21.4
kernel-livepatch-MICRO-6-0_Update_4 Linux Micro 6.1, Linux Micro 6.0 1-1.2
kernel-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-22.1
kernel-source-rt Linux Micro 6.1, Linux Micro 6.0 6.4.0-22.1
kernel-livepatch-MICRO-6-0-RT_Update_4 Linux Micro 6.1, Linux Micro 6.0 1-1.1

suse advisories SUSE-SU-2025:20164-1 SUSE-SU-2025:20247-1 SUSE-SU-2025:20163-1 SUSE-SU-2025:20246-1 SUSE-SU-2024:4387-1 SUSE-SU-2024:4364-1

kernel-source-longterm openSUSE Tumbleweed 6.12.11-1.1
kernel-source openSUSE Tumbleweed 6.11.8-1.1

opensuse advisories openSUSE-SU-2025:14705-1 openSUSE-SU-2024:14500-1

kernel CBL-Mariner 2.0 5.15.173.1-1
kernel Azure Linux 3.0 6.6.56.1-5

azure linux advisories AZL-50761 AZL-50954

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-47720 updated 2026-11-05 cvss 5.5

kernel: drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-10-21)

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux

Classification

Weakness

CWE-476 NULL Pointer Dereference

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2024-47720
NVD CVE-2024-47720

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary