Deadlock Vulnerability in Linux Kernel: AMDGPU DebugFS Files
Summary
DEBIAN-CVE-2024-35795: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix deadlock while reading mqd from debugfs An errant disk backup on my desktop got into debugfs and triggered the following deadlock scenar... Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. The 'linux' package in Debian versions 13 and 14 is crucial for system stability and performance. This package includes drivers and subsystems for various hardware components, including graphics processing units (GPUs). The vulnerability in question affects the AMDGPU driver, which is responsible for managing AMD graphics cards, particularly in scenarios involving debug file system (debugfs) interactions.
Vulnerability Detail
In the Linux kernel, a deadlock vulnerability has been identified within the AMDGPU debugfs files. This issue arises when an errant disk backup interacts with debugfs, leading to a circular locking dependency. The deadlock scenario occurs when a task attempts to acquire a lock that is already held by another task, which in turn is waiting for the first lock to be released. This can result in system instability, potentially causing the machine to hard-reset. The vulnerability was introduced in earlier versions and has been fixed in version 6.7.12-1.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risks associated with the deadlock scenario.
Conclusion
The deadlock vulnerability in the Linux kernel's AMDGPU debugfs files poses a significant risk to system stability. Users are urged to update their 'linux' package to version 6.7.12-1 or later to mitigate this issue. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The deadlock vulnerability involves a circular locking dependency in the AMDGPU debugfs files, which can lead to system instability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By checking your manifest file with Vulert's playground, you can identify if your application is affected.
Failure to address this vulnerability may result in system crashes or hard resets, affecting system reliability and performance.
Yes, the vulnerability has been fixed in version 6.7.12-1 of the Linux package.
It is advisable to regularly check for updates to your packages, ideally on a weekly basis, to ensure you have the latest security patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
