Deadlock Vulnerability in Linux Kernel's RAID5 Implementation
Summary
CVE-2024-39476: In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING Xiao reported that lvm2 test lvconvert-raid-takeover.sh can hang with... Affects linux versions < 5.10.221-1. Fixed in 5.10.221-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management, process control, and system security. It supports various file systems and network protocols, making it versatile for different applications. The RAID5 implementation within the kernel is designed for data redundancy and performance, allowing multiple disks to work together to protect against data loss. However, a recent vulnerability has been identified that could lead to system hangs under specific conditions, impacting the reliability of systems using RAID5 configurations.
Vulnerability Detail
The vulnerability, identified as CVE-2024-39476, arises from a deadlock condition in the RAID5 implementation of the Linux kernel. Specifically, the issue occurs when the raid5d() function waits for itself to clear the MD_SB_CHANGE_PENDING flag while holding the reconfig_mutex lock. This situation can lead to a CPU being consumed at 100% due to a deadloop, causing the system to hang. The problem was traced back to a complex dependency in the code that has existed since before version 2.6 of the kernel. If another context holds the reconfig_mutex, the md_check_recovery() function cannot update the super_block, resulting in the deadlock. This vulnerability has been reported to affect various Debian versions of the Linux kernel.
How To Fix
Minimum fixed version
5.10.221-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid triggering the deadlock by ensuring that no other processes hold the reconfig_mutex while performing RAID5 operations. However, this is not a permanent solution and updating the kernel is strongly recommended.
Conclusion
CVE-2024-39476 represents a significant vulnerability in the Linux kernel's RAID5 implementation that can lead to system hangs due to a deadlock. Users are advised to update their systems to the latest kernel versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in open-source software effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2024-39476 is a vulnerability in the Linux kernel's RAID5 implementation that can cause system hangs due to a deadlock condition.
If your system uses the RAID5 configuration in the Linux kernel, it may hang under certain conditions, leading to potential data loss or system unavailability.
You should update your Linux kernel to the fixed versions as soon as possible to mitigate the risk of this vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without signing up.
The CVSS score for CVE-2024-39476 is 5.5, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
