Mutex Initialization Vulnerability in Linux Kernel LEDs Driver
Summary
CVE-2024-42129: In the Linux kernel, the following vulnerability has been resolved: leds: mlxreg: Use devm_mutex_init() for mutex initialization In this driver LEDs are registered using devm_led_classdev_register() so they are automatic... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system processes. The kernel includes various drivers, including those for LED devices, which allow for the control of LED indicators on hardware. The vulnerability in question arises from improper mutex initialization in the mlxreg LED driver, which can lead to system instability when the module is removed.
Vulnerability Detail
In the Linux kernel, specifically within the mlxreg LED driver, a vulnerability has been identified due to the use of a mutex that is destroyed during the module's removal process. When the LEDs are unregistered, the led_set_brightness callback is invoked, which attempts to use a mutex that has already been destroyed. This can lead to undefined behavior, potential crashes, or other security issues, as the system may attempt to access invalid memory locations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the fix as soon as it is available in the updated kernel packages.
Conclusion
The CVE-2024-42129 vulnerability in the Linux kernel's mlxreg LED driver poses a significant risk due to improper mutex handling. It is crucial for users and developers to apply the recommended fixes promptly to ensure system stability and security. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2024-42129 is a vulnerability in the Linux kernel's mlxreg LED driver that involves improper mutex management, potentially leading to system instability.
If your system uses the affected Linux kernel version with the mlxreg LED driver, it may experience crashes or undefined behavior when the module is removed.
The vulnerability affects multiple versions of the Linux kernel across Debian 11, 12, and 13, with specific fixes available for Debian 13.
Yes, a patch is expected to be included in future kernel updates. Users should monitor their package manager for updates.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
