Deadlock Vulnerability in Linux Kernel's pds_core Driver - CVE-2024-35968
Summary
DEBIAN-CVE-2024-35968: In the Linux kernel, the following vulnerability has been resolved: pds_core: Fix pdsc_check_pci_health function to use work thread When the driver notices fw_status == 0xff it tries to perform a PCI reset on itself via... Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. The pds_core driver is responsible for managing PCI devices, ensuring they operate correctly and efficiently. This driver is crucial for maintaining system stability and performance, but it is susceptible to vulnerabilities that can lead to deadlocks and system crashes.
Vulnerability Detail
CVE-2024-35968 is a vulnerability in the Linux kernel's pds_core driver that arises when the driver attempts to perform a PCI reset while in the context of its health thread. This situation leads to a deadlock because the health thread cannot be stopped or flushed while it is executing the reset function. The vulnerability can cause system instability and crashes, particularly when unloading the driver in a firmware down or dead state, as evidenced by warning messages in the kernel logs.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risks associated with this issue.
Conclusion
CVE-2024-35968 is a significant vulnerability in the Linux kernel's pds_core driver that can lead to system deadlocks and instability. It is essential to update to the patched version 6.8.9-1 to mitigate the risks associated with this vulnerability. Regular monitoring and timely updates are crucial for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2024-35968 is a vulnerability in the Linux kernel's pds_core driver that can lead to system deadlocks when performing PCI resets.
This vulnerability can cause system instability and crashes, especially when unloading the driver in a firmware down state.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
While there are no specific workarounds, it is crucial to monitor your system for any unusual behavior and plan to apply the patch as soon as possible.
Detailed information about CVE-2024-35968 can be found in the Debian security advisories and the official Linux kernel documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
