CVE-2023-52498

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
11/03/2024
Last modified:
12/12/2024

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> PM: sleep: Fix possible deadlocks in core system-wide PM code<br /> <br /> It is reported that in low-memory situations the system-wide resume core<br /> code deadlocks, because async_schedule_dev() executes its argument<br /> function synchronously if it cannot allocate memory (and not only in<br /> that case) and that function attempts to acquire a mutex that is already<br /> held. Executing the argument function synchronously from within<br /> dpm_async_fn() may also be problematic for ordering reasons (it may<br /> cause a consumer device&amp;#39;s resume callback to be invoked before a<br /> requisite supplier device&amp;#39;s one, for example).<br /> <br /> Address this by changing the code in question to use<br /> async_schedule_dev_nocall() for scheduling the asynchronous<br /> execution of device suspend and resume functions and to directly<br /> run them synchronously if async_schedule_dev_nocall() returns false.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.10.210 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.149 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 6.1.76 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.15 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.7.3 (excluding)