CVE-2024-57798

drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()

High · published January 11, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
12.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()

While receiving an MST up request message from one thread in

drm_dp_mst_handle_up_req(), the MST topology could be removed from

another thread via drm_dp_mst_topology_mgr_set_mst(false), freeing

mst_primary and setting drm_dp_mst_topology_mgr::mst_primary to NULL.

This could lead to a NULL deref/use-after-free of mst_primary in

drm_dp_mst_handle_up_req().

Avoid the above by holding a reference for mst_primary in

drm_dp_mst_handle_up_req() while it's used.

v2: Fix kfreeing the request if getting an mst_primary reference fails.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00222 · 12.1th percentile
Published
2025-01-11T12:39Z
EPSS history
Timeline
  • 11 JAN 12:39Z
    drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()
    cvelistv5