Deadlock Vulnerability in Linux Kernel's Nouveau Driver - CVE-2024-35786
Summary
DEBIAN-CVE-2024-35786: In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix stale locked mutex in nouveau_gem_ioctl_pushbuf If VM_BIND is enabled on the client the legacy submission ioctl can't be used, however... Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for all other parts of the system. It manages hardware resources and enables software applications to communicate with the hardware. The 'linux' package in Debian distributions is crucial for system stability and performance. This vulnerability affects the Nouveau driver, which is an open-source graphics device driver for NVIDIA graphics cards. The issue arises when the VM_BIND feature is enabled, leading to potential deadlocks during certain operations.
Vulnerability Detail
In the Linux kernel, specifically within the Nouveau driver, a vulnerability has been identified where a stale locked mutex can occur in the nouveau_gem_ioctl_pushbuf function. When VM_BIND is enabled on the client, the legacy submission ioctl cannot be used. However, if a client attempts to use this ioctl, it results in an error, but the mutex remains unlocked. This situation can lead to a deadlock in the nouveau_drm_postclose function or any other Nouveau ioctl call, potentially causing system instability or crashes.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The CVE-2024-35786 vulnerability in the Linux kernel's Nouveau driver poses a significant risk of deadlocks, affecting system stability. Users are urged to update their systems to the latest patched version to mitigate this risk. Regular monitoring using tools like Vulert can help keep your software secure.
See every vulnerability recorded for linux →
FAQ
CVE-2024-35786 is a vulnerability in the Linux kernel's Nouveau driver that can lead to deadlocks due to improper mutex handling.
If exploited, this vulnerability can cause system instability or crashes, particularly when using NVIDIA graphics cards with the Nouveau driver.
If you are using Debian 13 or 14 with the affected version of the Linux kernel, your system may be vulnerable. You can check your system using Vulert's playground without any signup.
The best way to protect your system is to update the 'linux' package to the patched version 6.7.12-1 or later.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
