CVE-2024-26775

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26775
In the Linux kernel, the following vulnerability has been resolved: aoe: avoid potential deadlock at set_capacity Move set_capacity() outside of the section procected by (&d->lock). To avoid possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- [1] lock(&bdev->bd_size_lock); local_irq_disable(); [2] lock(&d->lock); [3] lock(&bdev->bd_size_lock); <Interrupt> [4] lock(&d->lock); *** DEADLOCK *** Where [1](&bdev->bd_size_lock) hold by zram_add()->set_capacity(). [2]lock(&d->lock) hold by aoeblk_gdalloc(). And aoeblk_gdalloc() is trying to acquire [3](&bdev->bd_size_lock) at set_capacity() call. In this situation an attempt to acquire [4]lock(&d->lock) from aoecmd_cfg_rsp() will lead to deadlock. So the simplest solution is breaking lock dependency [2](&d->lock) -> [3](&bdev->bd_size_lock) by moving set_capacity() outside.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/19a77b27163820f793b4d022979ffdca8f659b77 Patch
https://git.kernel.org/stable/c/2d623c94fbba3554f4446ba6f3c764994e8b0d26 Patch
https://git.kernel.org/stable/c/673629018ba04906899dcb631beec34d871f709c Patch
https://git.kernel.org/stable/c/e169bd4fb2b36c4b2bee63c35c740c85daeb2e86 Patch
https://git.kernel.org/stable/c/19a77b27163820f793b4d022979ffdca8f659b77 Patch
https://git.kernel.org/stable/c/2d623c94fbba3554f4446ba6f3c764994e8b0d26 Patch
https://git.kernel.org/stable/c/673629018ba04906899dcb631beec34d871f709c Patch
https://git.kernel.org/stable/c/e169bd4fb2b36c4b2bee63c35c740c85daeb2e86 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
History

07 Jan 2025, 17:29

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/19a77b27163820f793b4d022979ffdca8f659b77 - () https://git.kernel.org/stable/c/19a77b27163820f793b4d022979ffdca8f659b77 - Patch
References () https://git.kernel.org/stable/c/2d623c94fbba3554f4446ba6f3c764994e8b0d26 - () https://git.kernel.org/stable/c/2d623c94fbba3554f4446ba6f3c764994e8b0d26 - Patch
References () https://git.kernel.org/stable/c/673629018ba04906899dcb631beec34d871f709c - () https://git.kernel.org/stable/c/673629018ba04906899dcb631beec34d871f709c - Patch
References () https://git.kernel.org/stable/c/e169bd4fb2b36c4b2bee63c35c740c85daeb2e86 - () https://git.kernel.org/stable/c/e169bd4fb2b36c4b2bee63c35c740c85daeb2e86 - Patch
CWE CWE-667

21 Nov 2024, 09:03

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/19a77b27163820f793b4d022979ffdca8f659b77 - () https://git.kernel.org/stable/c/19a77b27163820f793b4d022979ffdca8f659b77 -
References () https://git.kernel.org/stable/c/2d623c94fbba3554f4446ba6f3c764994e8b0d26 - () https://git.kernel.org/stable/c/2d623c94fbba3554f4446ba6f3c764994e8b0d26 -
References () https://git.kernel.org/stable/c/673629018ba04906899dcb631beec34d871f709c - () https://git.kernel.org/stable/c/673629018ba04906899dcb631beec34d871f709c -
References () https://git.kernel.org/stable/c/e169bd4fb2b36c4b2bee63c35c740c85daeb2e86 - () https://git.kernel.org/stable/c/e169bd4fb2b36c4b2bee63c35c740c85daeb2e86 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: aoe: evita un posible punto muerto en set_capacity Mueve set_capacity() fuera de la sección procesada por (&amp;d-&gt;lock). Para evitar una posible interrupción en un escenario de bloqueo inseguro: CPU0 CPU1 ---- ---- [1] lock(&amp;bdev-&gt;bd_size_lock); local_irq_disable(); [2] bloquear(&amp;d-&gt;bloquear); [3] bloquear(&amp;bdev-&gt;bd_size_lock); [4] bloqueo(&amp;d-&gt;bloqueo); *** DEADLOCK *** Donde [1](&amp;bdev-&gt;bd_size_lock) mantenido por zram_add()-&gt;set_capacity(). [2]bloqueo(&amp;d-&gt;bloqueo) retenido por aoeblk_gdalloc(). Y aoeblk_gdalloc() está intentando adquirir [3](&amp;bdev-&gt;bd_size_lock) en la llamada set_capacity(). En esta situación, un intento de adquirir [4]lock(&amp;d-&gt;lock) de aoecmd_cfg_rsp() provocará un punto muerto. Entonces, la solución más simple es romper la dependencia del bloqueo [2](&amp;d-&gt;lock) -&gt; [3](&amp;bdev-&gt;bd_size_lock) moviendo set_capacity() afuera.

03 Apr 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-03 17:15

Updated : 2025-01-07 17:29

NVD link : CVE-2024-26775

Mitre link : CVE-2024-26775

CVE.ORG link : CVE-2024-26775

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-667

Improper Locking