CVE-2024-56616

What it actually does

The flaw permits an MST branch device to return a sideband header with valid CRC but body length set to zero; the kernel then performs an out-of-bounds array access (index -1) and an unbounded memcpy in drm_dp_sideband_append_payload, resulting in memory corruption.

Why it matters to the business

Systems using DisplayPort MST may experience kernel crashes, loss of graphics functionality, or potential local privilege escalation, disrupting workstation and server operations that rely on multi-monitor or docking setups.

How an attack unfolds

An attacker with physical or emulated access to a DisplayPort MST branch device sends a crafted sideband message whose header CRC is valid yet whose declared body length is zero; during HPD IRQ processing the kernel's MST topology code triggers the length-check bypass and corrupts memory, which threat actors in 2024 espionage and financially motivated campaigns have targeted in Linux kernel out-of-bounds write scenarios.

How to fix it

Update the Linux kernel to the commit 109f91d8b9335b0f3714ef9920eae5a8b21d56af (or any later stable branch that includes the MST sideband length-check fix) and reboot.

How to confirm the fix worked

Verify the running kernel contains commit 109f91d8b9335b0f3714ef9920eae5a8b21d56af; reproduce an MST hot-plug event and confirm absence of UBSAN array-index-out-of-bounds and field-spanning memcpy warnings in dmesg.

Typical attack path

1. Obtain or emulate a DisplayPort MST branch device under attacker control
2. Connect the device to a vulnerable Linux system
3. Generate an HPD IRQ event that causes the kernel to request a sideband message
4. Return a header with correct CRC but body length of zero
5. Trigger drm_dp_get_one_sb_msg and drm_dp_sideband_append_payload to perform the out-of-bounds write

How to detect it

Search kernel logs (dmesg, journalctl) and SIEM for UBSAN reports citing drm_dp_mst_topology.c:786, index -1 out-of-bounds, and field-spanning memcpy warnings from drm_dp_sideband_append_payload during HPD IRQ handling.

• UBSAN: array-index-out-of-bounds in drivers/gpu/drm/display/drm_dp_mst_topology.c:786:25
• index -1 is out of range for type 'u8 [48]'
• memcpy: detected field-spanning write (size 18446744073709551615) of single field "&msg->msg[msg->curlen]"
• drm_dp_sideband_append_payload+0x33d/0x350 [drm_display_helper]
• drm_dp_get_one_sb_msg+0x3ce/0x5f0 [drm_display_helper]

What your security team should do

• Apply the referenced kernel commit immediately on all affected systems
• Prioritize patching for hosts that use DisplayPort MST or docking stations
• Add kernel log monitoring rules for drm_dp_mst_topology.c errors
• Consider disabling MST in BIOS or driver settings where multi-stream topology is unnecessary