Critical Null Pointer Dereference in Linux Kernel's Sii902x Bridge Driver
Summary
CVE-2024-26607: In the Linux kernel, the following vulnerability has been resolved: drm/bridge: sii902x: Fix probing race issue A null pointer dereference crash has been observed rarely on TI platforms using sii9022 bridge: [ 53.271356]... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. The Sii902x bridge driver is responsible for interfacing with Sii9022 video bridges, enabling video output on various platforms. This driver is crucial for ensuring proper communication between the graphics subsystem and display devices. However, a recent vulnerability has been identified that can lead to system crashes under specific conditions, particularly on Texas Instruments (TI) platforms.
Vulnerability Detail
The vulnerability arises from a null pointer dereference during the probing process of the Sii902x bridge driver. When the driver attempts to read the Extended Display Identification Data (EDID) before the necessary I2C setup is complete, it can lead to a crash. This issue is triggered when the tidss driver probes while the Sii902x driver is still initializing, causing a race condition that results in the dereference of a null pointer. The potential ramifications include system instability and crashes, which can affect user experience and system reliability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the Sii902x bridge driver until the fix is applied. This may involve disabling the driver or using alternative hardware that does not rely on the Sii902x bridge.
Conclusion
The identified vulnerability in the Sii902x bridge driver of the Linux kernel poses a significant risk of system crashes due to a null pointer dereference. It is crucial for users and developers to apply the recommended fix promptly to ensure system stability. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software ecosystem.
See every vulnerability recorded for linux →
FAQ
A null pointer dereference occurs when a program attempts to access memory at an address that has not been initialized, leading to crashes or undefined behavior.
This vulnerability can cause system crashes, particularly on systems using the Sii902x bridge driver, leading to instability and potential data loss.
Yes, a patch is available that modifies the driver code to prevent the null pointer dereference. Users should apply the fix as soon as possible.
Yes, you can use tools like Vulert, which monitors open-source vulnerabilities in your software by analyzing manifest files like package-lock.json.
If you cannot apply the fix, consider using alternative hardware or disabling the Sii902x bridge driver to mitigate the risk of crashes.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
