Critical Mutex Locking Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2024-40922: In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: don't lock while !TASK_RUNNING There is a report of io_rsrc_ref_quiesce() locking a mutex while not TASK_RUNNING, which is due to forgett... Affects linux versions < 6.9.7-1. Fixed in 6.9.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to software applications. It is known for its stability, performance, and flexibility, making it a popular choice for servers, desktops, and embedded systems. However, vulnerabilities can arise, impacting system security and performance. This specific vulnerability affects the io_uring subsystem, which is designed for asynchronous I/O operations, allowing applications to perform I/O operations without blocking the execution of other tasks.
Vulnerability Detail
In the Linux kernel, a critical vulnerability has been identified in the io_uring subsystem, specifically related to the function io_rsrc_ref_quiesce(). The issue arises when a mutex is locked while the task is not in a TASK_RUNNING state, leading to potential deadlocks and system instability. The vulnerability is caused by the failure to restore the task state after calling io_run_task_work_sig(), resulting in blocking operations being executed when the task is not ready to run. This can lead to warnings and crashes, as indicated by the CPU and PID logs in the error report. The ramifications of this vulnerability could include degraded system performance, application crashes, and potential denial of service.
How To Fix
Minimum fixed version
6.9.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
The identified mutex locking vulnerability in the Linux kernel's io_uring subsystem poses significant risks to system stability and performance. Users are strongly advised to update their kernel to the patched version 6.9.7-1 to mitigate these risks. Regular monitoring of vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper mutex locking in the io_uring subsystem of the Linux kernel, which can lead to system instability.
You can check if your system is affected by using tools like Vulert, which monitors open-source vulnerabilities in your software.
The consequences may include application crashes, degraded performance, and potential denial of service.
Yes, a patch is available in version 6.9.7-1 of the Linux kernel package.
You can apply the patch by updating your Linux kernel package using the command: 'sudo apt-get update && sudo apt-get install linux'.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
