CVE-2024-49976
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
21/10/2024
Last modified:
25/10/2024
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
tracing/timerlat: Drop interface_lock in stop_kthread()<br />
<br />
stop_kthread() is the offline callback for "trace/osnoise:online", since<br />
commit 5bfbcd1ee57b ("tracing/timerlat: Add interface_lock around clearing<br />
of kthread in stop_kthread()"), the following ABBA deadlock scenario is<br />
introduced:<br />
<br />
T1 | T2 [BP] | T3 [AP]<br />
osnoise_hotplug_workfn() | work_for_cpu_fn() | cpuhp_thread_fun()<br />
| _cpu_down() | osnoise_cpu_die()<br />
mutex_lock(&interface_lock) | | stop_kthread()<br />
| cpus_write_lock() | mutex_lock(&interface_lock)<br />
cpus_read_lock() | cpuhp_kick_ap() |<br />
<br />
As the interface_lock here in just for protecting the "kthread" field of<br />
the osn_var, use xchg() instead to fix this issue. Also use<br />
for_each_online_cpu() back in stop_per_cpu_kthreads() as it can take<br />
cpu_read_lock() again.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.6.51 (including) | 6.6.55 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.10.10 (including) | 6.10.14 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.11 (including) | 6.11.3 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



