Deadlock Vulnerability in Linux Kernel's DRM Subsystem - CVE-2024-47729
Summary
DEBIAN-CVE-2024-47729: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use reserved copy engine for user binds on faulting devices User binds map to engines with can fault, faults depend on user binds completion, th... Affects linux versions < 6.11.2-1. Fixed in 6.11.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It supports a wide range of functionalities, including process management, memory management, and device drivers. The DRM (Direct Rendering Manager) subsystem is responsible for interfacing with graphics hardware, enabling efficient rendering and display of graphics. This vulnerability affects the user binds to engines that can fault, potentially leading to deadlocks in the system.
Vulnerability Detail
The vulnerability identified as CVE-2024-47729 arises from the handling of user binds in the DRM subsystem of the Linux kernel. When user binds are mapped to engines that can fault, the completion of these binds may depend on the occurrence of faults, which can lead to deadlocks. This situation occurs because the system may wait indefinitely for a resource that is not available due to the faulting condition. The vulnerability has been resolved by ensuring that a reserved copy engine is used for user binds on devices that are prone to faults, thereby preventing the deadlock scenario.
How To Fix
Minimum fixed version
6.11.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package as described in the 'how_to_fix' section.
Conclusion
CVE-2024-47729 is a critical vulnerability in the Linux kernel that can lead to deadlocks in systems using the DRM subsystem. Users are advised to update their Linux packages to the patched version to ensure system stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software without requiring code access.
See every vulnerability recorded for linux →
FAQ
CVE-2024-47729 is a vulnerability in the Linux kernel's DRM subsystem that can lead to deadlocks due to improper handling of user binds on faulting devices.
If your system is running a vulnerable version of the Linux kernel, it may experience deadlocks, causing applications to hang and potentially leading to system instability.
The vulnerability affects versions of the Linux kernel prior to 6.11.2-1 in Debian 13 and 14.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
While there are no specific workarounds provided, it is crucial to plan for an update to mitigate the risk of deadlocks. Regularly monitor your system for updates and consider using tools like Vulert for real-time alerts.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
