In the Linux kernel, the following vulnerability has been resolved:
drm/dp_mst: Fix resetting msg rx state after topology removal
If the MST topology is removed during the reception of an MST down reply or MST up request sideband message, the drmdpmsttopologymgr::upreqrecv/downreprecv states could be reset from one thread via drmdpmsttopologymgrsetmst(false), racing with the reading/parsing of the message from another thread via drmdpmsthandledownrep() or drmdpmsthandleupreq(). The race is possible since the reader/parser doesn't hold any lock while accessing the reception state. This in turn can lead to a memory corruption in the reader/parser as described by commit bd2fccac61b4 ("drm/dp_mst: Fix MST sideband message body length check").
Fix the above by resetting the message reception state if needed before reading/parsing a message. Another solution would be to hold the drmdpmsttopologymgr::lock for the whole duration of the message reception/parsing in drmdpmsthandledownrep() and drmdpmsthandleupreq(), however this would require a bigger change. Since the fix is also needed for stable, opting for the simpler solution in this patch.
[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 514.0,
"function_hash": "52873535134672776305029472145245874788"
},
"target": {
"file": "drivers/gpu/drm/display/drm_dp_mst_topology.c",
"function": "drm_dp_mst_hpd_irq_handle_event"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6fa67d26de385c3c7a23c1e109a0e23bfda4ec7",
"signature_version": "v1",
"id": "CVE-2024-57876-4236949b"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 514.0,
"function_hash": "52873535134672776305029472145245874788"
},
"target": {
"file": "drivers/gpu/drm/display/drm_dp_mst_topology.c",
"function": "drm_dp_mst_hpd_irq_handle_event"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94b33b2d7640e807869451384eb88321dd0ffbd4",
"signature_version": "v1",
"id": "CVE-2024-57876-44f5a9b5"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"200786817449508362784888456512226975220",
"56064077162759208915530918940798811782",
"238892235952866267974586501201332067835"
],
"threshold": 0.9
},
"target": {
"file": "include/drm/display/drm_dp_mst_helper.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be826b4451fd187a7c0b04be4f8243d5df6e0450",
"signature_version": "v1",
"id": "CVE-2024-57876-5912343d"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 514.0,
"function_hash": "52873535134672776305029472145245874788"
},
"target": {
"file": "drivers/gpu/drm/display/drm_dp_mst_topology.c",
"function": "drm_dp_mst_hpd_irq_handle_event"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be826b4451fd187a7c0b04be4f8243d5df6e0450",
"signature_version": "v1",
"id": "CVE-2024-57876-5c84a302"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"205976665736676801250157997581306112459",
"262443707663020340907513050837608440576",
"49650371471172540657376502075697459303",
"171916401962396337182578593574729267388",
"332685811325458822574418695039828831286",
"54581110838814791127399315799805572668",
"288339006468610600346314196166125568302",
"123109653510916071986203868852459198386",
"241169088951220163408095231479159758945",
"233223596440143929069146627577247263438",
"54382127422870684280730737590174933213",
"179116808741557638460652975156798523030",
"65160460216470815063451056425560827491",
"114529576042828426273641651806824433502"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/display/drm_dp_mst_topology.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6fa67d26de385c3c7a23c1e109a0e23bfda4ec7",
"signature_version": "v1",
"id": "CVE-2024-57876-5cdf0ab8"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"200786817449508362784888456512226975220",
"56064077162759208915530918940798811782",
"238892235952866267974586501201332067835"
],
"threshold": 0.9
},
"target": {
"file": "include/drm/display/drm_dp_mst_helper.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6fa67d26de385c3c7a23c1e109a0e23bfda4ec7",
"signature_version": "v1",
"id": "CVE-2024-57876-61759935"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"205976665736676801250157997581306112459",
"262443707663020340907513050837608440576",
"49650371471172540657376502075697459303",
"171916401962396337182578593574729267388",
"332685811325458822574418695039828831286",
"54581110838814791127399315799805572668",
"288339006468610600346314196166125568302",
"123109653510916071986203868852459198386",
"241169088951220163408095231479159758945",
"233223596440143929069146627577247263438",
"54382127422870684280730737590174933213",
"179116808741557638460652975156798523030",
"65160460216470815063451056425560827491",
"114529576042828426273641651806824433502"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/display/drm_dp_mst_topology.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d834d20d2e86c52ed5cab41763fa61e6071680ef",
"signature_version": "v1",
"id": "CVE-2024-57876-7185f889"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 1212.0,
"function_hash": "157759604027720333800867606764801181210"
},
"target": {
"file": "drivers/gpu/drm/display/drm_dp_mst_topology.c",
"function": "drm_dp_mst_topology_mgr_set_mst"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be826b4451fd187a7c0b04be4f8243d5df6e0450",
"signature_version": "v1",
"id": "CVE-2024-57876-72e9b1c8"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"200786817449508362784888456512226975220",
"56064077162759208915530918940798811782",
"238892235952866267974586501201332067835"
],
"threshold": 0.9
},
"target": {
"file": "include/drm/display/drm_dp_mst_helper.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d834d20d2e86c52ed5cab41763fa61e6071680ef",
"signature_version": "v1",
"id": "CVE-2024-57876-7d80d466"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"205976665736676801250157997581306112459",
"262443707663020340907513050837608440576",
"49650371471172540657376502075697459303",
"171916401962396337182578593574729267388",
"332685811325458822574418695039828831286",
"54581110838814791127399315799805572668",
"288339006468610600346314196166125568302",
"123109653510916071986203868852459198386",
"241169088951220163408095231479159758945",
"233223596440143929069146627577247263438",
"54382127422870684280730737590174933213",
"179116808741557638460652975156798523030",
"65160460216470815063451056425560827491",
"114529576042828426273641651806824433502"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/display/drm_dp_mst_topology.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be826b4451fd187a7c0b04be4f8243d5df6e0450",
"signature_version": "v1",
"id": "CVE-2024-57876-86df6ec1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 514.0,
"function_hash": "52873535134672776305029472145245874788"
},
"target": {
"file": "drivers/gpu/drm/display/drm_dp_mst_topology.c",
"function": "drm_dp_mst_hpd_irq_handle_event"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d834d20d2e86c52ed5cab41763fa61e6071680ef",
"signature_version": "v1",
"id": "CVE-2024-57876-9660a83a"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"205976665736676801250157997581306112459",
"262443707663020340907513050837608440576",
"49650371471172540657376502075697459303",
"171916401962396337182578593574729267388",
"332685811325458822574418695039828831286",
"54581110838814791127399315799805572668",
"288339006468610600346314196166125568302",
"123109653510916071986203868852459198386",
"241169088951220163408095231479159758945",
"233223596440143929069146627577247263438",
"54382127422870684280730737590174933213",
"179116808741557638460652975156798523030",
"65160460216470815063451056425560827491",
"114529576042828426273641651806824433502"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/display/drm_dp_mst_topology.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94b33b2d7640e807869451384eb88321dd0ffbd4",
"signature_version": "v1",
"id": "CVE-2024-57876-97194dd3"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 1239.0,
"function_hash": "189571360185797215559203058258055388333"
},
"target": {
"file": "drivers/gpu/drm/display/drm_dp_mst_topology.c",
"function": "drm_dp_mst_topology_mgr_set_mst"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d834d20d2e86c52ed5cab41763fa61e6071680ef",
"signature_version": "v1",
"id": "CVE-2024-57876-9ec47b5a"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"200786817449508362784888456512226975220",
"56064077162759208915530918940798811782",
"238892235952866267974586501201332067835"
],
"threshold": 0.9
},
"target": {
"file": "include/drm/display/drm_dp_mst_helper.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94b33b2d7640e807869451384eb88321dd0ffbd4",
"signature_version": "v1",
"id": "CVE-2024-57876-a2ce96f6"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 1212.0,
"function_hash": "157759604027720333800867606764801181210"
},
"target": {
"file": "drivers/gpu/drm/display/drm_dp_mst_topology.c",
"function": "drm_dp_mst_topology_mgr_set_mst"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6fa67d26de385c3c7a23c1e109a0e23bfda4ec7",
"signature_version": "v1",
"id": "CVE-2024-57876-aa1cc988"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 1239.0,
"function_hash": "189571360185797215559203058258055388333"
},
"target": {
"file": "drivers/gpu/drm/display/drm_dp_mst_topology.c",
"function": "drm_dp_mst_topology_mgr_set_mst"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94b33b2d7640e807869451384eb88321dd0ffbd4",
"signature_version": "v1",
"id": "CVE-2024-57876-b942772c"
}
]