Menu

Star on GitHub · 3.4k

CVE-2024-35927

5.5 · MEDIUM

In the Linux kernel, the following vulnerability has been resolved: drm: Check output polling initialized before disabling In drm_kms_helper_poll_disable() check if output polling support is init…

Published May 19, 2024EPSS 0.21%

Overview

CVE-2024-35927 is a medium-severity vulnerability. It was published on May 19, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm: Check output polling initialized before disabling

In drm_kms_helper_poll_disable() check if output polling

support is initialized before disabling polling. If not flag

this as a warning.

Additionally in drm_mode_config_helper_suspend() and

drm_mode_config_helper_resume() calls, that re the callers of these

functions, avoid invoking them if polling is not initialized.

For drivers like hyperv-drm, that do not initialize connector

polling, if suspend is called without this check, it leads to

suspend failure with following stack

[ 770.719392] Freezing remaining freezable tasks ... (elapsed 0.001 seconds) done.

[ 770.720592] printk: Suspending console(s) (use no_console_suspend to debug)

[ 770.948823] ------------[ cut here ]------------

[ 770.948824] WARNING: CPU: 1 PID: 17197 at kernel/workqueue.c:3162 __flush_work.isra.0+0x212/0x230

[ 770.948831] Modules linked in: rfkill nft_counter xt_conntrack xt_owner udf

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Frequently asked questions

What is CVE-2024-35927?

CVE-2024-35927 is a medium-severity vulnerability. It was published on May 19, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-35927?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-35927?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2024-35927?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2024-35927 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related MEDIUM CVEs from 2024

View all
Watch the demo →