Critical NULL Dereference Vulnerability in Linux Kernel - CVE-2024-57798
Summary
CVE-2024-57798: In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() While receiving an MST up request message from one thread in drm_dp_mst_ha... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to software applications. It is widely used in various environments, from servers to embedded systems. This vulnerability specifically affects the Direct Rendering Manager (DRM) component, which handles graphics processing and display management. The vulnerability arises from improper handling of the MST (Multi-Stream Transport) topology, potentially leading to system instability and crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the drm_dp_mst_handle_up_req() function. When an MST up request message is received from one thread, the MST topology can be removed by another thread, leading to a situation where the mst_primary pointer is dereferenced after being freed. This results in a NULL dereference or a use-after-free condition, which can cause crashes or unpredictable behavior in the system. The vulnerability is particularly concerning as it can be exploited in multi-threaded environments where graphics processing is critical.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, it is advisable to monitor system logs for any unusual behavior and to avoid running applications that heavily rely on graphics processing until the patch is applied.
Conclusion
CVE-2024-57798 represents a significant vulnerability in the Linux kernel that can lead to serious system issues if left unaddressed. It is crucial for users and administrators to apply the necessary updates to mitigate the risks associated with this vulnerability. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2024-57798 is a vulnerability in the Linux kernel that can lead to NULL dereference or use-after-free conditions in the Direct Rendering Manager.
Exploitation of this vulnerability can cause system crashes, instability, or unpredictable behavior, particularly in multi-threaded graphics applications.
Yes, a patch is available for Debian 12 in version 6.1.123-1. Users should update their Linux packages to this version or later.
While there are no specific workarounds, it is recommended to monitor system behavior and avoid running graphics-intensive applications until the patch is applied.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
