CVE-2024-35952 drm/ast: Fix soft lockup

2024-05-2009:41:46

Linux

www.cve.org

linux

kernel

vulnerability

cve-2024-35952

drm/ast

soft lockup

fix

while-loop

infinite-loop

scratch

dpmcu

bmc

6.3 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.6%

JSON

In the Linux kernel, the following vulnerability has been resolved:

drm/ast: Fix soft lockup

There is a while-loop in ast_dp_set_on_off() that could lead to
infinite-loop. This is because the register, VGACRI-Dx, checked in
this API is a scratch register actually controlled by a MCU, named
DPMCU, in BMC.

These scratch registers are protected by scu-lock. If suc-lock is not
off, DPMCU can not update these registers and then host will have soft
lockup due to never updated status.

DPMCU is used to control DP and relative registers to handshake with
host’s VGA driver. Even the most time-consuming task, DP’s link
training, is less than 100ms. 200ms should be enough.

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/gpu/drm/ast/ast_dp.c"
    ],
    "versions": [
      {
        "version": "594e9c04b586",
        "lessThan": "8a6fea3fcb57",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "594e9c04b586",
        "lessThan": "a81b2acd43e2",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "594e9c04b586",
        "lessThan": "35768baf0fdf",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "594e9c04b586",
        "lessThan": "bc004f503822",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/gpu/drm/ast/ast_dp.c"
    ],
    "versions": [
      {
        "version": "5.19",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "5.19",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.1.87",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.6.28",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.8.7",
        "lessThanOrEqual": "6.8.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.9",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]