CVE-2024-56616

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/dp_mst: Fix MST sideband message body length check

Fix the MST sideband message body length check, which must be at least 1

byte accounting for the message body CRC (aka message data CRC) at the

end of the message.

This fixes a case where an MST branch device returns a header with a

correct header CRC (indicating a correctly received body length), with

the body length being incorrectly set to 0. This will later lead to a

memory corruption in drm_dp_sideband_append_payload() and the following

errors in dmesg:

UBSAN: array-index-out-of-bounds in drivers/gpu/drm/display/drm_dp_mst_topology.c:786:25

index -1 is out of range for type 'u8 [48]'

Call Trace:

drm_dp_sideband_append_payload+0x33d/0x350 [drm_display_helper]

drm_dp_get_one_sb_msg+0x3ce/0x5f0 [drm_display_helper]

drm_dp_mst_hpd_irq_handle_event+0xc8/0x1580 [drm_display_helper]

memcpy: detected field-spanning write (size 184467440737

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References