Critical Deadlock Vulnerability in Linux Kernel Package: linux
Summary
DEBIAN-CVE-2024-58042: In the Linux kernel, the following vulnerability has been resolved: rhashtable: Fix potential deadlock by moving schedule_work outside lock Move the hash table growth check and work scheduling outside the rht lock to pre... Affects linux versions < 6.12.13-1. Fixed in 6.12.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is widely used across various platforms, including servers, desktops, and embedded systems. The kernel's functionality includes process management, memory management, device drivers, and system calls. Due to its critical role, vulnerabilities in the Linux kernel can have severe implications, affecting system stability and security.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the rhashtable implementation, which could lead to a potential deadlock scenario. This issue arises from a circular locking dependency involving nested locks between the rhashtable bucket, rq lock, and dsq lock. The original implementation could trigger a lockdep warning, indicating a risk of deadlock. The vulnerability was resolved by moving the hash table growth check and work scheduling outside the rht lock, thus breaking the potential deadlock chain and enhancing the flexibility of rhashtable usage in scheduler and workqueue contexts.
How To Fix
Minimum fixed version
6.12.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The recommended action is to update to the patched version as soon as it is available.
Conclusion
The identified vulnerability in the Linux kernel's rhashtable implementation poses a significant risk of deadlock, which can impact system stability. It is crucial for users to update to the patched version 6.12.13-1 to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a potential deadlock scenario in the rhashtable implementation of the Linux kernel, which could lead to system instability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software without requiring access to the code. Visit Vulert Scanner to check if your application is affected.
If exploited, this vulnerability could lead to system hangs or crashes due to deadlocks, affecting the overall performance and reliability of the system.
Yes, a patch is available in version 6.12.13-1 of the Linux package. Users are encouraged to update to this version.
While there are no specific workarounds, it is advisable to monitor your system closely for any unusual behavior until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
