System Hang on Resume with Thunderbolt Monitor in Linux Kernel
Summary
CVE-2024-50003: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix system hang while resume with TBT monitor [Why] Connected with a Thunderbolt monitor and do the suspend and the system may hang whi... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of Linux operating systems, managing hardware and system resources. It provides essential services for all other parts of the operating system, including process management, memory management, and device drivers. The kernel is crucial for system stability and performance, and vulnerabilities within it can lead to significant issues, such as system hangs or crashes. This specific vulnerability affects systems connected to Thunderbolt monitors, particularly during the resume process from suspension.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified that causes the system to hang when resuming from suspension while connected to a Thunderbolt (TBT) monitor. This issue arises when the Hot Plug Detect (HPD) signal from the TBT monitor is triggered during the resume process, leading to a call to drm_client_modeset_probe() while the drm_connector's master device is NULL. This mismanagement can disrupt the pipe topology, resulting in a system hang. The vulnerability is critical as it affects system usability and can lead to data loss if not addressed.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid connecting Thunderbolt monitors during the resume process. Additionally, users may consider disabling the Thunderbolt connection before suspending the system to prevent the HPD signal from triggering.
Conclusion
CVE-2024-50003 is a significant vulnerability in the Linux kernel that affects systems using Thunderbolt monitors, leading to potential system hangs during the resume process. Users are advised to update their kernel to the patched version and consider temporary workarounds until they can apply the fix. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2024-50003 is a vulnerability in the Linux kernel that causes system hangs when resuming from suspension with a Thunderbolt monitor connected.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The primary consequence is a system hang during the resume process, which can lead to data loss and disrupt normal operations.
Yes, updating the Linux kernel to the patched version that addresses CVE-2024-50003 is the permanent fix.
If immediate updates are not possible, consider using the workaround of disconnecting Thunderbolt monitors before suspending the system.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
