CVE-2024-42309

What it actually does

Null pointer dereference in psb_intel_lvds_get_modes when drm_mode_duplicate returns NULL without a preceding check, leading to a crash in the gma500 DRM driver.

Why it matters to the business

Local denial of service that can crash affected Linux systems using the gma500 graphics hardware, with low likelihood of remote exploitation or data loss.

How an attack unfolds

An attacker with local access triggers the LVDS modes retrieval code path so that drm_mode_duplicate fails and returns NULL; the missing check then causes an immediate kernel dereference and crash. No named threat actors have been observed exploiting this specific issue.

How to fix it

Apply the upstream kernel fix that adds a NULL check after drm_mode_duplicate. Where packaged fixes are available, update the mongodb/mongodb package to version 1.9.2 or later.

How to confirm the fix worked

Confirm the patch is present by inspecting the psb_intel_lvds_get_modes function for a NULL return check on drm_mode_duplicate; test by forcing the allocation failure path and verifying no crash occurs.

Typical attack path

1. Obtain local user access on a system with the gma500 driver loaded
2. Trigger the psb_intel_lvds_get_modes function
3. Force drm_mode_duplicate to fail
4. Trigger NULL pointer dereference resulting in kernel panic

How to detect it

Review kernel ring buffer and syslog for oops or panic entries containing psb_intel_lvds_get_modes or drm_mode_duplicate; correlate with local user activity around the timestamp of any crash.

What your security team should do

• Prioritize patching systems that expose the gma500 driver to local users
• Monitor kernel logs for oops messages referencing psb_intel_lvds_get_modes
• Apply the mongodb/mongodb 1.9.2 update if that package is in use