Message-ID: <2025011105-CVE-2025-23125-069a@gregkh>
Date: Sat, 11 Jan 2025 15:31:08 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2025-23125: drm/dp_mst: Fix resetting msg rx state after topology removal

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/dp_mst: Fix resetting msg rx state after topology removal

If the MST topology is removed during the reception of an MST down reply
or MST up request sideband message, the
drm_dp_mst_topology_mgr::up_req_recv/down_rep_recv states could be reset
from one thread via drm_dp_mst_topology_mgr_set_mst(false), racing with
the reading/parsing of the message from another thread via
drm_dp_mst_handle_down_rep() or drm_dp_mst_handle_up_req(). The race is
possible since the reader/parser doesn't hold any lock while accessing
the reception state. This in turn can lead to a memory corruption in the
reader/parser as described by commit bd2fccac61b4 ("drm/dp_mst: Fix MST
sideband message body length check").

Fix the above by resetting the message reception state if needed before
reading/parsing a message. Another solution would be to hold the
drm_dp_mst_topology_mgr::lock for the whole duration of the message
reception/parsing in drm_dp_mst_handle_down_rep() and
drm_dp_mst_handle_up_req(), however this would require a bigger change.
Since the fix is also needed for stable, opting for the simpler solution
in this patch.

The Linux kernel CVE team has assigned CVE-2025-23125 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.1.18 with commit b30fcedeba643ca16eaa6212c1245598b7cd830d and fixed in 6.1.120 with commit 94b33b2d7640e807869451384eb88321dd0ffbd4
	Issue introduced in 6.3 with commit 1d082618bbf3b6755b8cc68c0a8122af2842d593 and fixed in 6.6.66 with commit d834d20d2e86c52ed5cab41763fa61e6071680ef
	Issue introduced in 6.3 with commit 1d082618bbf3b6755b8cc68c0a8122af2842d593 and fixed in 6.12.5 with commit be826b4451fd187a7c0b04be4f8243d5df6e0450
	Issue introduced in 6.3 with commit 1d082618bbf3b6755b8cc68c0a8122af2842d593 and fixed in 6.13-rc2 with commit a6fa67d26de385c3c7a23c1e109a0e23bfda4ec7
	Issue introduced in 5.10.173 with commit ee4a4282d78d96e07e714c28ca54679713fa2157
	Issue introduced in 5.15.100 with commit db35e49413a4d03ea0c003598803e49956f59324
	Issue introduced in 6.2.5 with commit a579ed4613b5a64074963988ad481e43cf3b917b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-23125
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/display/drm_dp_mst_topology.c
	include/drm/display/drm_dp_mst_helper.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/94b33b2d7640e807869451384eb88321dd0ffbd4
	https://git.kernel.org/stable/c/d834d20d2e86c52ed5cab41763fa61e6071680ef
	https://git.kernel.org/stable/c/be826b4451fd187a7c0b04be4f8243d5df6e0450
	https://git.kernel.org/stable/c/a6fa67d26de385c3c7a23c1e109a0e23bfda4ec7

Powered by blists - more mailing lists