lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025011107-CVE-2024-57876-1d02@gregkh> Date: Sat, 11 Jan 2025 15:49:09 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-57876: drm/dp_mst: Fix resetting msg rx state after topology removal Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Fix resetting msg rx state after topology removal If the MST topology is removed during the reception of an MST down reply or MST up request sideband message, the drm_dp_mst_topology_mgr::up_req_recv/down_rep_recv states could be reset from one thread via drm_dp_mst_topology_mgr_set_mst(false), racing with the reading/parsing of the message from another thread via drm_dp_mst_handle_down_rep() or drm_dp_mst_handle_up_req(). The race is possible since the reader/parser doesn't hold any lock while accessing the reception state. This in turn can lead to a memory corruption in the reader/parser as described by commit bd2fccac61b4 ("drm/dp_mst: Fix MST sideband message body length check"). Fix the above by resetting the message reception state if needed before reading/parsing a message. Another solution would be to hold the drm_dp_mst_topology_mgr::lock for the whole duration of the message reception/parsing in drm_dp_mst_handle_down_rep() and drm_dp_mst_handle_up_req(), however this would require a bigger change. Since the fix is also needed for stable, opting for the simpler solution in this patch. The Linux kernel CVE team has assigned CVE-2024-57876 to this issue. Affected and fixed versions =========================== Issue introduced in 6.1.18 with commit b30fcedeba643ca16eaa6212c1245598b7cd830d and fixed in 6.1.120 with commit 94b33b2d7640e807869451384eb88321dd0ffbd4 Issue introduced in 6.3 with commit 1d082618bbf3b6755b8cc68c0a8122af2842d593 and fixed in 6.6.66 with commit d834d20d2e86c52ed5cab41763fa61e6071680ef Issue introduced in 6.3 with commit 1d082618bbf3b6755b8cc68c0a8122af2842d593 and fixed in 6.12.5 with commit be826b4451fd187a7c0b04be4f8243d5df6e0450 Issue introduced in 6.3 with commit 1d082618bbf3b6755b8cc68c0a8122af2842d593 and fixed in 6.13-rc2 with commit a6fa67d26de385c3c7a23c1e109a0e23bfda4ec7 Issue introduced in 5.10.173 with commit ee4a4282d78d96e07e714c28ca54679713fa2157 Issue introduced in 5.15.100 with commit db35e49413a4d03ea0c003598803e49956f59324 Issue introduced in 6.2.5 with commit a579ed4613b5a64074963988ad481e43cf3b917b Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-57876 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/display/drm_dp_mst_topology.c include/drm/display/drm_dp_mst_helper.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/94b33b2d7640e807869451384eb88321dd0ffbd4 https://git.kernel.org/stable/c/d834d20d2e86c52ed5cab41763fa61e6071680ef https://git.kernel.org/stable/c/be826b4451fd187a7c0b04be4f8243d5df6e0450 https://git.kernel.org/stable/c/a6fa67d26de385c3c7a23c1e109a0e23bfda4ec7
Powered by blists - more mailing lists