CVE-2024-49985

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
21/10/2024
Last modified:
03/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume<br /> <br /> In case there is any sort of clock controller attached to this I2C bus<br /> controller, for example Versaclock or even an AIC32x4 I2C codec, then<br /> an I2C transfer triggered from the clock controller clk_ops .prepare<br /> callback may trigger a deadlock on drivers/clk/clk.c prepare_lock mutex.<br /> <br /> This is because the clock controller first grabs the prepare_lock mutex<br /> and then performs the prepare operation, including its I2C access. The<br /> I2C access resumes this I2C bus controller via .runtime_resume callback,<br /> which calls clk_prepare_enable(), which attempts to grab the prepare_lock<br /> mutex again and deadlocks.<br /> <br /> Since the clock are already prepared since probe() and unprepared in<br /> remove(), use simple clk_enable()/clk_disable() calls to enable and<br /> disable the clock on runtime suspend and resume, to avoid hitting the<br /> prepare_lock mutex.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.0 (including) 5.10.227 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.168 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 6.1.113 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.55 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.10.14 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.11 (including) 6.11.3 (excluding)
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*