CVE-2024-36949: Vulnerability in linux-libc-dev - Kernel: amd/amdkfd: Sync All Devices to Wait All Processes Being Evicted
Summary
CVE-2024-36949: In the Linux kernel, the following vulnerability has been resolved: amd/amdkfd: sync all devices to wait all processes being evicted If there are more than one device doing reset in parallel, the first device will call k... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package in the Linux kernel that provides the C library headers for use by the kernel. It is an essential component for building and compiling kernel modules. The package is responsible for defining system calls, data structures, and other essential functions used by the kernel. This vulnerability affects the linux-libc-dev package, specifically the amd/amdkfd module. The amd/amdkfd module is responsible for managing the AMD GPU kernel driver. The vulnerability allows for a race condition where multiple devices performing a reset in parallel can lead to processes not being properly evicted, resulting in potential page faults and system instability.
Vulnerability Detail
The vulnerability arises when multiple devices initiate a reset simultaneously. The first device triggers the kfd_suspend_all_processes() function, which is responsible for evicting all processes on all devices. This eviction process takes time to complete. However, if other devices start their reset and recovery procedures without waiting for the eviction process to finish, processes may not be properly evicted. As a result, restored processes can cause page faults and disrupt system stability. This vulnerability has a CVSS score of 5.5, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by updating the linux-libc-dev package to the latest version.
Conclusion
The linux-libc-dev package, specifically the amd/amdkfd module, is vulnerable to a race condition during device resets. This can result in processes not being properly evicted, leading to potential page faults and system instability. To mitigate this vulnerability, it is crucial to update the linux-libc-dev package to version 6.1.90-1 or later. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package in the Linux kernel that provides the C library headers for use by the kernel. It is essential for building and compiling kernel modules.
The amd/amdkfd module is responsible for managing the AMD GPU kernel driver in the Linux kernel.
kfd_suspend_all_processes() is a function in the amd/amdkfd module that evicts all processes on all devices to prepare for a reset.
The vulnerability can lead to restored processes causing page faults and system instability, potentially disrupting normal system operation.
The CVSS score of this vulnerability is 5.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
