From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F1C5C1F16B for ; Sat, 11 Jan 2025 14:49:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736606959; cv=none; b=cPMxYXcSYtVnl6Z+4emZ8dhUUq64OlX3eIOxYfCzat6ngK0rBaDEpqgq9fguBWd/QmiGMdOkpXX1vF9mifvySt9jDFCYPBUOGR2h8zzAhXcQ1YZHAdJzoE53HVHslcI8SdgN3EiOEL3JbHAhRTsoDutArYYoulUkmPQZMwUydwk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736606959; c=relaxed/simple; bh=GH5XJsZ7/WHPu75udpT2S3A4iRr0Zl09xFM/Q7Wg5Sw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=FgDtzAg/60SjXSCTMeBpgQ1CVzS+NVMLzcKQRrNTdBGYZVOYvOiH38EtYd87/GruS5SuQX9I3sqj8wVFOhwjpBOKhbTlvbjOU8iSH9ou3yMTDDZ2HAUXUr0EYTagPYCCFphj+oj0V20nZeqMiq5z00ykm+F1sPcbpTGpvlT+6o0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=OTh+DNfP; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="OTh+DNfP" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2F14CC4CED2; Sat, 11 Jan 2025 14:49:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1736606957; bh=GH5XJsZ7/WHPu75udpT2S3A4iRr0Zl09xFM/Q7Wg5Sw=; h=From:To:Cc:Subject:Date:Reply-to:From; b=OTh+DNfPvSkfvV/JSZNiYBoIzI18dJ1UQ53/jlQyQDvq9Umb7aP35iHfy9lnxbyck XqdZQu/uzDP6o3cu1u4mpAvX+VvoBjNhbLH95f7X5SJaG3ArrRWfm0AUMoIueqZiUo s0PIEmjDmfzBm41JELBswoBzIE1bzHwhhkMeSPwc= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2024-57876: drm/dp_mst: Fix resetting msg rx state after topology removal Date: Sat, 11 Jan 2025 15:49:09 +0100 Message-ID: <2025011107-CVE-2024-57876-1d02@gregkh> X-Mailer: git-send-email 2.48.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3620; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=GH5XJsZ7/WHPu75udpT2S3A4iRr0Zl09xFM/Q7Wg5Sw=; b=owGbwMvMwCRo6H6F97bub03G02pJDOlNLU/OCReek0rZt3nO5Z3rHqtUGFSLV94+4+U3KWHFn a4bu+zLOmJZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAiWYIMC/b0BOn9Fkq1nrek oJm7+2fdl8jJSgzzjLrDdz2NO1duuMpO/VS116YbG7mXAQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Fix resetting msg rx state after topology removal If the MST topology is removed during the reception of an MST down reply or MST up request sideband message, the drm_dp_mst_topology_mgr::up_req_recv/down_rep_recv states could be reset from one thread via drm_dp_mst_topology_mgr_set_mst(false), racing with the reading/parsing of the message from another thread via drm_dp_mst_handle_down_rep() or drm_dp_mst_handle_up_req(). The race is possible since the reader/parser doesn't hold any lock while accessing the reception state. This in turn can lead to a memory corruption in the reader/parser as described by commit bd2fccac61b4 ("drm/dp_mst: Fix MST sideband message body length check"). Fix the above by resetting the message reception state if needed before reading/parsing a message. Another solution would be to hold the drm_dp_mst_topology_mgr::lock for the whole duration of the message reception/parsing in drm_dp_mst_handle_down_rep() and drm_dp_mst_handle_up_req(), however this would require a bigger change. Since the fix is also needed for stable, opting for the simpler solution in this patch. The Linux kernel CVE team has assigned CVE-2024-57876 to this issue. Affected and fixed versions =========================== Issue introduced in 6.1.18 with commit b30fcedeba643ca16eaa6212c1245598b7cd830d and fixed in 6.1.120 with commit 94b33b2d7640e807869451384eb88321dd0ffbd4 Issue introduced in 6.3 with commit 1d082618bbf3b6755b8cc68c0a8122af2842d593 and fixed in 6.6.66 with commit d834d20d2e86c52ed5cab41763fa61e6071680ef Issue introduced in 6.3 with commit 1d082618bbf3b6755b8cc68c0a8122af2842d593 and fixed in 6.12.5 with commit be826b4451fd187a7c0b04be4f8243d5df6e0450 Issue introduced in 6.3 with commit 1d082618bbf3b6755b8cc68c0a8122af2842d593 and fixed in 6.13-rc2 with commit a6fa67d26de385c3c7a23c1e109a0e23bfda4ec7 Issue introduced in 5.10.173 with commit ee4a4282d78d96e07e714c28ca54679713fa2157 Issue introduced in 5.15.100 with commit db35e49413a4d03ea0c003598803e49956f59324 Issue introduced in 6.2.5 with commit a579ed4613b5a64074963988ad481e43cf3b917b Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-57876 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/display/drm_dp_mst_topology.c include/drm/display/drm_dp_mst_helper.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/94b33b2d7640e807869451384eb88321dd0ffbd4 https://git.kernel.org/stable/c/d834d20d2e86c52ed5cab41763fa61e6071680ef https://git.kernel.org/stable/c/be826b4451fd187a7c0b04be4f8243d5df6e0450 https://git.kernel.org/stable/c/a6fa67d26de385c3c7a23c1e109a0e23bfda4ec7