CVE-2024-50003

What it actually does

During resume with a Thunderbolt monitor connected, HPD triggers drm_client_modeset_probe while drm_connector->dev->master is NULL, corrupting pipe topology and hanging the system.

Why it matters to the business

Workstations or laptops using Thunderbolt displays may become unresponsive after suspend/resume cycles, leading to lost productivity and requiring hard resets or reboots.

How an attack unfolds

An attacker with local or physical access connects a Thunderbolt monitor, triggers suspend/resume, and relies on the race during HPD processing to cause a kernel-level hang; listed threat actors have targeted similar Linux kernel resource and bounds issues in broader campaigns.

How to fix it

Apply the upstream fix that skips TBT monitor HPD handling during resume; for listed Rocky Linux 8 packages, upgrade each to the stated fixed version such as python-markupsafe 0:0.23-19.el8, python-attrs 0:17.4.0-10.module+el8.5.0+706+735ec4b3, and equivalent updates for the remaining packages.

How to confirm the fix worked

Confirm kernel or package versions match the fixed releases, reproduce a suspend/resume cycle with a Thunderbolt monitor attached, and verify the system resumes without hanging.

Typical attack path

1. Connect Thunderbolt monitor to target system
2. Initiate system suspend
3. Trigger resume sequence
4. Allow HPD event to invoke modeset probe with NULL master
5. Observe resulting pipe topology corruption and system hang

How to detect it

Review kernel logs around resume events for drm or amd-display errors mentioning NULL master or pipe topology corruption; correlate with Thunderbolt monitor connection timestamps.

What your security team should do

• Prioritize patching systems that regularly use Thunderbolt monitors within the next maintenance window
• Review and apply the exact fixed versions provided for each Rocky Linux 8 Python package
• Monitor vendor advisories for additional backports or distribution updates