CVE-2024-35952

What it actually does

A while-loop in ast_dp_set_on_off() spins indefinitely waiting for VGACRI-Dx register updates that never occur when the scu-lock protecting DPMCU-controlled scratch registers remains held, resulting in soft lockup.

Why it matters to the business

Linux systems using AST graphics hardware with BMC may experience sudden unresponsiveness or kernel hangs during DP operations, causing service outages and requiring reboots with no remote exploitation reported.

How an attack unfolds

An attacker with local access triggers DP link training or on/off operations that invoke ast_dp_set_on_off(); if the scu-lock is held the DPMCU cannot update the register and the loop never exits, producing a soft lockup.

How to fix it

Update the Linux kernel to the commit 8a6fea3fcb577a543ef67683ca7105bde49a38fb or later stable release containing the fix; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 8a6fea3fcb577a543ef67683ca7105bde49a38fb; exercise DP link training paths and verify the loop exits within expected time bounds instead of hanging.

Typical attack path

1. Obtain local execution on a vulnerable Linux kernel with AST DRM driver loaded
2. Perform graphics or display operations that call ast_dp_set_on_off()
3. Hold or contend for the scu-lock so DPMCU cannot update VGACRI-Dx
4. Observe indefinite loop and resulting soft lockup / DoS

How to detect it

Review kernel logs for repeated ast_dp_set_on_off entries or soft lockup warnings; inspect for processes stuck in the DRM DP code path; correlate with BMC or DPMCU activity if available.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all systems using the ast DRM driver
• Monitor for soft lockup messages in dmesg related to ast_dp_set_on_off
• Apply the update before the next scheduled maintenance window given the 877-day exposure window