// For flags

CVE-2024-26775

aoe: avoid potential deadlock at set_capacity

Severity Score

"-"
*CVSS v-

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

In the Linux kernel, the following vulnerability has been resolved:

aoe: avoid potential deadlock at set_capacity

Move set_capacity() outside of the section procected by (&d->lock).
To avoid possible interrupt unsafe locking scenario:

CPU0 CPU1
---- ----
[1] lock(&bdev->bd_size_lock);
local_irq_disable();
[2] lock(&d->lock);
[3] lock(&bdev->bd_size_lock);
<Interrupt>
[4] lock(&d->lock);

*** DEADLOCK ***

Where [1](&bdev->bd_size_lock) hold by zram_add()->set_capacity().
[2]lock(&d->lock) hold by aoeblk_gdalloc(). And aoeblk_gdalloc()
is trying to acquire [3](&bdev->bd_size_lock) at set_capacity() call.
In this situation an attempt to acquire [4]lock(&d->lock) from
aoecmd_cfg_rsp() will lead to deadlock.

So the simplest solution is breaking lock dependency
[2](&d->lock) -> [3](&bdev->bd_size_lock) by moving set_capacity()
outside.

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: aoe: evita un posible punto muerto en set_capacity Mueve set_capacity() fuera de la sección procesada por (&amp;d-&gt;lock). Para evitar una posible interrupción en un escenario de bloqueo inseguro: CPU0 CPU1 ---- ---- [1] lock(&amp;bdev-&gt;bd_size_lock); local_irq_disable(); [2] bloquear(&amp;d-&gt;bloquear); [3] bloquear(&amp;bdev-&gt;bd_size_lock); [4] bloqueo(&amp;d-&gt;bloqueo); *** DEADLOCK *** Donde [1](&amp;bdev-&gt;bd_size_lock) mantenido por zram_add()-&gt;set_capacity(). [2]bloqueo(&amp;d-&gt;bloqueo) retenido por aoeblk_gdalloc(). Y aoeblk_gdalloc() está intentando adquirir [3](&amp;bdev-&gt;bd_size_lock) en la llamada set_capacity(). En esta situación, un intento de adquirir [4]lock(&amp;d-&gt;lock) de aoecmd_cfg_rsp() provocará un punto muerto. Entonces, la solución más simple es romper la dependencia del bloqueo [2](&amp;d-&gt;lock) -&gt; [3](&amp;bdev-&gt;bd_size_lock) moviendo set_capacity() afuera.

*Credits: N/A
CVSS Scores
Attack Vector
-
Attack Complexity
-
Privileges Required
-
User Interaction
-
Scope
-
Confidentiality
-
Integrity
-
Availability
-
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-02-19 CVE Reserved
  • 2024-04-03 CVE Published
  • 2024-04-04 EPSS Updated
  • 2024-12-19 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
< 6.1.80
Search vendor "Linux" for product "Linux Kernel" and version " < 6.1.80"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
< 6.6.19
Search vendor "Linux" for product "Linux Kernel" and version " < 6.6.19"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
< 6.7.7
Search vendor "Linux" for product "Linux Kernel" and version " < 6.7.7"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
< 6.8
Search vendor "Linux" for product "Linux Kernel" and version " < 6.8"
en
Affected