Deadlock Vulnerability in Linux Kernel: linux Package Affected
Summary
DEBIAN-CVE-2024-40965: In the Linux kernel, the following vulnerability has been resolved: i2c: lpi2c: Avoid calling clk_get_rate during transfer Instead of repeatedly calling clk_get_rate for each transfer, lock the clock rate and cache the v... Affects linux versions < 6.9.7-1. Fixed in 6.9.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is responsible for executing processes, managing memory, and facilitating communication between software and hardware. The kernel is critical for system stability and performance, making it vital to address any vulnerabilities that may arise.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the i2c subsystem, specifically related to the lpi2c driver. The issue arises from the repeated calls to clk_get_rate during data transfers, which can lead to a deadlock situation. This occurs when the clock provider attempts to access the i2c bus while holding a mutex for the clock, resulting in a circular wait condition. The vulnerability can cause system instability and may prevent the proper functioning of devices relying on the affected driver, such as the tlv320aic32x4 audio codec.
How To Fix
Minimum fixed version
6.9.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected i2c driver until the system is updated to the patched version. Additionally, ensuring that the clock rate is locked and cached during transfers can help mitigate the risk of encountering the deadlock.
Conclusion
The identified deadlock vulnerability in the Linux kernel's i2c subsystem poses a risk to system stability and device functionality. It is crucial for users to update their linux package to the patched version 6.9.7-1 to mitigate this issue. Temporary workarounds are available, but applying the update is the most effective solution.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a deadlock issue in the i2c subsystem of the Linux kernel, caused by repeated calls to clk_get_rate during data transfers.
It can lead to system instability and prevent proper functioning of devices that rely on the affected i2c driver.
Yes, a patch is available in version 6.9.7-1 of the linux package.
As a temporary measure, avoid using the affected i2c driver until you can apply the update.
You can use Vulert, which monitors and alerts for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
