Lock Recursion Vulnerability in Linux Kernel AFS Package
Summary
CVE-2024-53090: In the Linux kernel, the following vulnerability has been resolved: afs: Fix lock recursion afs_wake_up_async_call() can incur lock recursion. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of Linux operating systems, managing hardware and software interactions. The AFS (Andrew File System) is a distributed file system that allows users to access files across a network as if they were on their local machine. This vulnerability affects the AFS implementation in the Linux kernel, which is crucial for maintaining file system integrity and performance in distributed environments.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the AFS module where the function afs_wake_up_async_call() can lead to lock recursion. This occurs because the function is called while holding the ->notify_lock, and it attempts to take a reference on the afs_call struct to pass it to a work queue. If the afs_call is already queued, it results in an extraneous reference that must be released, potentially leading to a situation where afs_put_call() may call back into AF_RXRPC, attempting to acquire the ->notify_lock again. This can cause a spinlock recursion, which is a critical issue that can crash the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can defer the problematic function call to a workqueue to avoid lock recursion. This can be implemented in the code by modifying the function calls to ensure they do not execute while holding the ->notify_lock.
Conclusion
The lock recursion vulnerability in the Linux kernel's AFS package poses a significant risk to system stability. It is crucial for users to update their systems to the latest patched version to mitigate this risk. Understanding the nature of the vulnerability and implementing the suggested fixes or workarounds can help maintain system integrity.
See every vulnerability recorded for linux →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
All versions of the Linux kernel prior to the patched version 6.11.9-1 for Debian 13 are affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update immediately, consider implementing the suggested workaround to defer the function call to a workqueue.
More information can be found in the official CVE database or by visiting the Linux kernel mailing lists and security advisories.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
