Deadlock Vulnerability in Linux Kernel's I2C Clock Management
Summary
CVE-2024-40965: In the Linux kernel, the following vulnerability has been resolved: i2c: lpi2c: Avoid calling clk_get_rate during transfer Instead of repeatedly calling clk_get_rate for each transfer, lock the clock rate and cache the v... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management, process control, and system resource allocation. It supports a wide range of hardware devices and is known for its stability and performance. However, vulnerabilities can arise, such as the one affecting the I2C (Inter-Integrated Circuit) subsystem, specifically in the LPI2C (Low Power I2C) driver. This vulnerability can lead to deadlocks during audio codec integration, impacting system reliability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the I2C subsystem, specifically within the LPI2C driver. The issue arises from the repeated calls to clk_get_rate during data transfers, which can lead to a deadlock situation. When integrating the tlv320aic32x4 audio codec, the clock provider locks the clk mutex while trying to access I2C, which in turn requires the same mutex for clk_get_rate. This circular dependency can cause the system to hang, severely affecting performance and functionality.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the tlv320aic32x4 audio codec until the kernel is updated. Additionally, if possible, limit the use of I2C transfers that require clock rate checks during critical operations to minimize the risk of encountering the deadlock.
Conclusion
The CVE-2024-40965 vulnerability in the Linux kernel's I2C subsystem poses a significant risk of deadlocks during audio codec operations. Users are advised to update their kernel versions to mitigate this issue and consider temporary workarounds until a fix is applied. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2024-40965 is a vulnerability in the Linux kernel's I2C subsystem that can lead to deadlocks during audio codec integration.
This vulnerability can cause your system to hang or become unresponsive when using certain audio codecs that rely on the I2C subsystem.
The vulnerability affects multiple versions of the Linux kernel across Debian 11, 12, and 13.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The CVSS score of this vulnerability is 5.5, indicating a moderate level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
