Deadlock Vulnerability in Linux Kernel's Padata Implementation
Summary
CVE-2024-47739: In the Linux kernel, the following vulnerability has been resolved: padata: use integer wrap around to prevent deadlock on seq_nr overflow When submitting more than 2^32 padata objects to padata_do_serial, the current so... Affects linux versions < 5.10.234-1. Fixed in 5.10.234-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management, process control, and system security. The padata subsystem is designed to optimize parallel processing of data, allowing for efficient handling of multiple data objects. However, a recent vulnerability has been identified that affects the sorting mechanism of padata objects, leading to potential deadlocks under specific conditions.
Vulnerability Detail
The vulnerability arises from the handling of padata objects when more than 2^32 instances are submitted to the padata_do_serial function. The current sorting implementation fails to correctly manage padata objects with an overflowed sequence number (seq_nr), causing these objects to be incorrectly prioritized in the reorder list. This mismanagement can lead to a deadlock situation during serialization, as the system cannot match the overflowed seq_nr with the processed objects, effectively halting operations.
How To Fix
Minimum fixed version
5.10.234-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. Users are advised to apply the patch as soon as it becomes available for their respective Debian versions.
Conclusion
The CVE-2024-47739 vulnerability in the Linux kernel's padata subsystem poses a significant risk of deadlocks when handling a large number of padata objects. Users are encouraged to update their systems to the patched version to mitigate this risk. Regular monitoring and prompt application of updates are essential for maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
This vulnerability can lead to deadlocks in the Linux kernel's padata subsystem, potentially freezing processes that rely on this functionality.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability affects Linux kernel versions in Debian 11, 12, and 13, with specific fixes available for Debian 13.
While the vulnerability may cause deadlocks, it does not directly lead to data loss. However, it can disrupt normal operations and service availability.
If an immediate update is not possible, monitor your system closely for signs of deadlock and plan to apply the patch as soon as it is feasible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.