Deadlock Vulnerability in Linux Kernel Package: linux (CVE-2024-26873)
Summary
DEBIAN-CVE-2024-26873: In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Fix a deadlock issue related to automatic dump If we issue a disabling PHY command, the device attached with it will go offline, if a 2... Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the Linux kernel that manages system resources and hardware interactions. It is essential for the functioning of the operating system, enabling communication between software and hardware. This package is widely used across various environments, making its security critical. The vulnerability in question affects the handling of SCSI commands, leading to potential system hangs under specific conditions.
Vulnerability Detail
In the Linux kernel, a deadlock issue has been identified in the SCSI subsystem, specifically related to the hisi_sas driver. When a PHY command is issued to disable a device, if a 2-bit ECC error occurs simultaneously, it can lead to a hung task. This situation arises because the hisi_hba semaphore is held while waiting for an internal abort command to complete, which cannot proceed due to the error. As a result, multiple tasks can become blocked, leading to system instability and potential downtime.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the hung task timeout message by executing the command: 'echo 0 > /proc/sys/kernel/hung_task_timeout_secs'. However, this does not fix the underlying issue and should only be used as a short-term measure.
Conclusion
The deadlock vulnerability in the Linux kernel (CVE-2024-26873) poses a significant risk to systems utilizing the linux package. Users are encouraged to update to the patched version to mitigate this risk. Temporary workarounds are available, but they do not address the root cause of the issue. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2024-26873 is a vulnerability in the Linux kernel that can lead to deadlocks in the SCSI subsystem under specific conditions.
This vulnerability can cause tasks to hang, leading to system instability and potential downtime, particularly in environments using SCSI devices.
Yes, a patch is available in version 6.7.12-1 of the linux package. Users are advised to update to this version or later.
If you cannot apply the patch, consider using the workaround to disable hung task timeout messages, but be aware that this does not resolve the underlying issue.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check if your application is affected without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
