CVE-2024-57876

What it actually does

Race condition in drm_dp_mst_topology_mgr allows concurrent reset of up_req_recv/down_rep_recv states via drm_dp_mst_topology_mgr_set_mst(false) while drm_dp_mst_handle_down_rep() or drm_dp_mst_handle_up_req() reads/parses messages without holding the lock, leading to memory corruption during sideband message handling after MST topology removal.

Why it matters to the business

Kernel memory corruption risk on Linux systems using DisplayPort MST displays can cause crashes, denial of service, or potential privilege escalation; low urgency given no known exploitation or ransomware use despite high ecosystem prevalence in the Linux kernel.

How an attack unfolds

An attacker triggers rapid MST topology removal (for example via hardware unplug or driver manipulation) while sideband messages are being received, racing the state reset against message parsing to corrupt kernel memory as described in the referenced prior fix for message length checks.

How to fix it

Update the Linux kernel to commit df0cc57e057f18e44dac8e6c18aba47ab53202f9 or later; alternatively apply the patch that resets message reception state before parsing.

How to confirm the fix worked

Confirm the running kernel contains commit df0cc57e057f18e44dac8e6c18aba47ab53202f9; review source for the added state reset before message handling and test topology removal under load.

Typical attack path

1. Obtain local access or hardware interaction capability on a Linux system with DP MST support
2. Trigger concurrent MST topology removal and sideband message reception
3. Exploit resulting memory corruption in the reader/parser threads
4. Achieve kernel crash, information leak, or code execution

How to detect it

Inspect kernel logs and dmesg for oops, warnings, or corruption messages involving drm_dp_mst_handle_down_rep, drm_dp_mst_handle_up_req, or topology_mgr_set_mst functions around the time of display topology changes.

What your security team should do

• Prioritize kernel upgrades to the fixed commit in all affected distributions
• Monitor kernel logs for DRM/DP MST related oops or corruption warnings
• Limit untrusted local access on systems with DisplayPort MST hardware until patched