In the Linux kernel, the following vulnerability has been resolved:
drm/bridge: sii902x: Fix probing race issue
A null pointer dereference crash has been observed rarely on TI platforms using sii9022 bridge:
[ 53.271356] sii902x_get_edid+0x34/0x70 [sii902x] [ 53.276066] sii902x_bridge_get_edid+0x14/0x20 [sii902x] [ 53.281381] drm_bridge_get_edid+0x20/0x34 [drm] [ 53.286305] drm_bridge_connector_get_modes+0x8c/0xcc [drm_kms_helper] [ 53.292955] drm_helper_probe_single_connector_modes+0x190/0x538 [drm_kms_helper] [ 53.300510] drm_client_modeset_probe+0x1f0/0xbd4 [drm] [ 53.305958] __drm_fb_helper_initial_config_and_unlock+0x50/0x510 [drm_kms_helper] [ 53.313611] drm_fb_helper_initial_config+0x48/0x58 [drm_kms_helper] [ 53.320039] drm_fbdev_dma_client_hotplug+0x84/0xd4 [drm_dma_helper] [ 53.326401] drm_client_register+0x5c/0xa0 [drm] [ 53.331216] drm_fbdev_dma_setup+0xc8/0x13c [drm_dma_helper] [ 53.336881] tidss_probe+0x128/0x264 [tidss] [ 53.341174] platform_probe+0x68/0xc4 [ 53.344841] really_probe+0x188/0x3c4 [ 53.348501] __driver_probe_device+0x7c/0x16c [ 53.352854] driver_probe_device+0x3c/0x10c [ 53.357033] __device_attach_driver+0xbc/0x158 [ 53.361472] bus_for_each_drv+0x88/0xe8 [ 53.365303] __device_attach+0xa0/0x1b4 [ 53.369135] device_initial_probe+0x14/0x20 [ 53.373314] bus_probe_device+0xb0/0xb4 [ 53.377145] deferred_probe_work_func+0xcc/0x124 [ 53.381757] process_one_work+0x1f0/0x518 [ 53.385770] worker_thread+0x1e8/0x3dc [ 53.389519] kthread+0x11c/0x120 [ 53.392750] ret_from_fork+0x10/0x20
The issue here is as follows:
- tidss probes, but is deferred as sii902x is still missing. - sii902x starts probing and enters sii902x_init(). - sii902x calls drm_bridge_add(). Now the sii902x bridge is ready from DRM's perspective. - sii902x calls sii902x_audio_codec_init() and platform_device_register_data() - The registration of the audio platform device causes probing of the deferred devices. - tidss probes, which eventually causes sii902x_bridge_get_edid() to be called. - sii902x_bridge_get_edid() tries to use the i2c to read the edid. However, the sii902x driver has not set up the i2c part yet, leading to the crash.
Fix this by moving the drm_bridge_add() to the end of the sii902x_init(), which is also at the very end of sii902x_probe().
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Feb 29, 2024 |
| Suse | — | Upgrade kernel-rt-vdsoUpgrade kernel-default-optionalUpgrade kernel-docs-htmlUpgrade dtb-caviumUpgrade kselftests-kmp-azureUpgrade dtb-broadcomUpgrade kernel-source-rtUpgrade dtb-xilinxUpgrade kernel-kvmsmall-vdsoUpgrade kernel-obs-buildUpgrade kernel-rt_debugUpgrade kselftests-kmp-rtUpgrade kernel-defaultUpgrade reiserfs-kmp-64kbUpgrade kernel-debug-vdsoUpgrade kernel-rt_debug-develUpgrade kernel-docsUpgrade ocfs2-kmp-defaultUpgrade dtb-appleUpgrade kernel-rt-extraUpgrade cluster-md-kmp-rtUpgrade kernel-debug-develUpgrade dlm-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-rt-optionalUpgrade gfs2-kmp-defaultUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade dtb-socionextUpgrade kernel-64kb-extraUpgrade kernel-rt-livepatchUpgrade kernel-azure-optionalUpgrade dtb-renesasUpgrade dtb-rockchipUpgrade dtb-alteraUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-develUpgrade kernel-preempt-develUpgrade gfs2-kmp-azureUpgrade kernel-source-vanillaUpgrade dtb-sprdUpgrade kernel-azureUpgrade reiserfs-kmp-azureUpgrade dtb-nvidiaUpgrade kernel-default-baseUpgrade reiserfs-kmp-rtUpgrade dtb-allwinnerUpgrade dtb-amdUpgrade kernel-symsUpgrade dtb-mediatekUpgrade kernel-syms-azureUpgrade kernel-rt-develUpgrade ocfs2-kmp-rtUpgrade kernel-default-develUpgrade kernel-zfcpdumpUpgrade cluster-md-kmp-azureUpgrade kernel-default-livepatchUpgrade kernel-devel-rtUpgrade kernel-64kb-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-macrosUpgrade kernel-devel-azureUpgrade kernel-default-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-extraUpgrade gfs2-kmp-rtUpgrade dlm-kmp-azureUpgrade dtb-qcomUpgrade kernel-source-azureUpgrade kernel-default-base-rebuildUpgrade kernel-azure-vdsoUpgrade dtb-hisiliconUpgrade dtb-armUpgrade dlm-kmp-64kbUpgrade kernel-syms-rtUpgrade kernel-64kb-optionalUpgrade kselftests-kmp-64kbUpgrade kernel-preemptUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmallUpgrade kernel-debugUpgrade dtb-marvellUpgrade cluster-md-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade dtb-amazonUpgrade kernel-azure-livepatch-develUpgrade dtb-apmUpgrade kernel-sourceUpgrade kernel-default-extraUpgrade kernel-rt_debug-vdsoUpgrade kernel-rtUpgrade kernel-rt-livepatch-develUpgrade dtb-freescaleUpgrade dtb-lgUpgrade gfs2-kmp-64kbUpgrade kernel-64kbUpgrade kernel-azure-develUpgrade dtb-amlogicUpgrade dtb-exynosUpgrade kernel-obs-qa | Mar 13, 2024 | Feb 29, 2024 |
| Ubuntu | — | Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-bluefieldUpgrade linux-image-oem-osp1Upgrade linux-image-oem-22.04dUpgrade linux-image-oem-20.04bUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-1069-gkeUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.4.0-1044-iotUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.15.0-125-generic-lpaeUpgrade linux-image-gkeopUpgrade linux-image-gkeop-5.4Upgrade linux-image-oem-22.04Upgrade linux-image-5.15.0-1065-ibmUpgrade linux-image-azure-lts-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-5.4.0-200-lowlatencyUpgrade linux-image-5.4.0-1054-xilinx-zynqmpUpgrade linux-image-5.15.0-1055-gkeopUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-intel-iotgUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.5.0-1021-nvidiaUpgrade linux-image-5.4.0-1102-gkeopUpgrade linux-image-intelUpgrade linux-image-6.5.0-1022-azure-fdeUpgrade linux-image-6.5.0-1024-oracle-64kUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-1134-oracleUpgrade linux-image-virtualUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-5.15.0-125-lowlatencyUpgrade linux-image-5.15.0-125-generic-64kUpgrade linux-image-6.5.0-1022-gcpUpgrade linux-image-gkeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oem-20.04cUpgrade linux-image-oracleUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oemUpgrade linux-image-6.5.0-41-lowlatencyUpgrade linux-image-6.5.0-41-generic-64kUpgrade linux-image-5.4.0-1082-ibmUpgrade linux-image-oem-20.04Upgrade linux-image-5.15.0-1038-xilinx-zynqmpUpgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1075-azureUpgrade linux-image-genericUpgrade linux-image-5.4.0-200-generic-lpaeUpgrade linux-image-nvidiaUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.4.0-1140-azureUpgrade linux-image-generic-64kUpgrade linux-image-5.15.0-125-lowlatency-64kUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-125-genericUpgrade linux-image-5.4.0-200-genericUpgrade linux-image-5.4.0-1135-awsUpgrade linux-image-lowlatency-64kUpgrade linux-image-starfiveUpgrade linux-image-oem-22.04aUpgrade linux-image-oracle-64kUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-oem-20.04dUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.5.0-1024-oracleUpgrade linux-image-azureUpgrade linux-image-azure-cvmUpgrade linux-image-6.5.0-1024-oemUpgrade linux-image-5.15.0-1071-gcpUpgrade linux-image-lowlatencyUpgrade linux-image-awsUpgrade linux-image-5.15.0-1072-awsUpgrade linux-image-oem-22.04bUpgrade linux-image-6.5.0-41-lowlatency-64kUpgrade linux-image-6.5.0-41-genericUpgrade linux-image-6.5.0-1021-awsUpgrade linux-image-nvidia-6.5Upgrade linux-image-6.5.0-1022-azureUpgrade linux-image-azure-fdeUpgrade linux-image-aws-lts-22.04Upgrade linux-image-6.5.0-1015-starfiveUpgrade linux-image-5.15.0-1065-raspiUpgrade linux-image-5.4.0-1139-gcpUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-aws-lts-20.04Upgrade linux-image-5.15.0-1070-oracleUpgrade linux-image-6.5.0-1017-laptopUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.4.0-1139-azureUpgrade linux-image-5.4.0-1119-raspiUpgrade linux-image-gcpUpgrade linux-image-5.4.0-1094-bluefieldUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-raspiUpgrade linux-image-6.5.0-1018-raspiUpgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-1078-azureUpgrade linux-image-ibmUpgrade linux-image-nvidia-64k-6.5Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-kvmUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.5.0-1021-nvidia-64kUpgrade linux-image-5.15.0-1067-nvidiaUpgrade linux-image-5.15.0-1067-intel-iotgUpgrade linux-image-5.4.0-1123-kvmUpgrade linux-image-5.15.0-1067-nvidia-lowlatencyUpgrade linux-image-azure-lts-20.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-laptop-23.10Upgrade linux-image-raspi2Upgrade linux-image-5.15.0-1069-kvm | May 17, 2024 | Feb 29, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Feb 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub