Deadlock Vulnerability in Linux Kernel's QETH Module
Summary
CVE-2021-47382: In the Linux kernel, the following vulnerability has been resolved: s390/qeth: fix deadlock during failing recovery Commit 0b9902c1fcc5 ("s390/qeth: fix deadlock during recovery") removed taking discipline_mutex inside q... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. The QETH (QEMU Ethernet) module is responsible for managing network interfaces on IBM S390 systems. It allows for efficient communication and resource management. However, due to a recent vulnerability, the QETH module is susceptible to deadlocks during recovery processes, which can disrupt network operations.
Vulnerability Detail
The vulnerability, identified as CVE-2021-47382, arises from a flaw in the QETH module's error handling during recovery. Specifically, the commit that aimed to fix potential deadlocks inadvertently left an error path that still takes the discipline_mutex lock. This oversight can lead to intermittent deadlocks when a QETH channel path is configured offline, creating a race condition between the qeth_do_reset function and the ccwgroup_remove process. The ramifications include potential system freezes and degraded network performance, impacting overall system reliability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid configuring QETH channel paths offline until the kernel is updated. This can help mitigate the risk of encountering deadlocks during recovery processes.
Conclusion
CVE-2021-47382 represents a significant vulnerability in the Linux kernel's QETH module, leading to potential deadlocks during recovery processes. Users are advised to update their systems promptly to mitigate risks associated with this issue. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2021-47382 is a vulnerability in the Linux kernel's QETH module that can lead to deadlocks during recovery processes.
The vulnerability can cause intermittent deadlocks, potentially freezing the system and degrading network performance.
The vulnerability affects Linux kernel versions prior to 5.14.12-1 on Debian systems.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, avoid configuring QETH channel paths offline as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
