CVE-2024-35790: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group
The DisplayPort driver's sysfs nodes may be present to the userspace before typecaltmodesetdrvdata() completes in dpaltmodeprobe. This means that a sysfs read can trigger a NULL pointer error by deferencing dp->hpd in hpdshow or dp->lock in pinassignmentshow, as devgetdrvdata() returns NULL in those cases.
Remove manual sysfs node creation in favor of adding attribute group as default for devices bound to the driver. The ATTRIBUTEGROUPS() macro is not used here otherwise the path to the sysfs nodes is no longer compliant with the ABI.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group
The Linux kernel CVE team has assigned CVE-2024-35790 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051708-CVE-2024-35790-6a80@gregkh/T
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference flaw in the DisplayPort driver. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35790?
CVE-2024-35790 has a severity rating that necessitates attention due to the potential impact on the Linux kernel's handling of sysfs nodes.
How do I fix CVE-2024-35790?
To fix CVE-2024-35790, upgrade the Linux kernel to version 6.6.24, 6.7.12, or 6.8 as appropriate for your system.
What versions of the Linux kernel are affected by CVE-2024-35790?
CVE-2024-35790 affects Linux kernel versions from 4.19 up to but not including 6.6.24, and 6.7.0 to 6.7.12.
Is there a workaround for CVE-2024-35790?
There are no documented workarounds for CVE-2024-35790; applying the provided updates is the recommended course of action.
Which products may be impacted by CVE-2024-35790?
CVE-2024-35790 may impact products including IBM Security Verify Governance and associated components.