PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() in Kernel
Summary
GSD-2022-1003977: PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store(). Affects Kernel versions < c3c6dc1853b8bf3c718f96fd8480a6eb09ba4831. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel is a crucial component of the Linux operating system that manages the system's resources and facilitates communication between hardware and software. It provides essential functionalities and drivers for various devices, including PCI devices. The PCI subsystem in the Kernel allows for the configuration and management of PCI devices. One such feature is Single Root I/O Virtualization (SR-IOV), which enables the creation of multiple virtual functions (VFs) from a single physical function (PF) of a PCI device. However, a vulnerability exists in the Kernel's handling of the sriov_numvfs_store() function, which can lead to a deadlock situation when acquiring the pci_dev_lock().
Vulnerability Detail
The vulnerability arises due to a potential AB/BA deadlock scenario when multiple threads attempt to acquire the pci_dev_lock() in the sriov_numvfs_store() function simultaneously. This can occur when one thread holds the lock and another thread tries to acquire it, resulting in a deadlock. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or disrupt the normal functioning of the system. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the Kernel's handling of the sriov_numvfs_store() function can lead to a deadlock situation when acquiring the pci_dev_lock(). It is recommended to update the Kernel to a version that includes the fix for this vulnerability to ensure the system's security and stability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could potentially lead to a denial-of-service (DoS) condition or disruption of normal system functioning.
You can use tools like Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert Playground allows you to analyze your manifest file, such as package-lock.json, without requiring access to the code or installation.
No, there is no known exploit for this vulnerability at the moment.
The recommended mitigation is to update the Kernel to a version that includes the fix for this vulnerability.
You can refer to the vulnerability details in the GSD database: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2022/1003xxx/GSD-2022-1003977.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
