PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() in Kernel
Summary
GSD-2022-1002701: PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store(). Affects Kernel versions < 59ea6b3ae51df7cd6bfd84c9c0030609b9315622. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that manages the communication between hardware and software. It provides essential services and functions to enable the proper functioning of the system. The vulnerability identified in the Kernel relates to a potential deadlock scenario involving the pci_dev_lock() function and the sriov_numvfs_store() function. Deadlocks can occur when two or more processes or threads are unable to proceed because each is waiting for the other to release a resource. In this case, the AB/BA deadlock can occur when two processes try to acquire the pci_dev_lock() in different orders, leading to a deadlock situation.
Vulnerability Detail
The vulnerability arises due to a potential AB/BA deadlock scenario when accessing the pci_dev_lock() function in conjunction with the sriov_numvfs_store() function. This vulnerability can result in system instability or crashes, impacting the availability and reliability of the system. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or disrupt the normal operation of the system. It is important to note that the impact and attack plausibility of this vulnerability have not been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can consider avoiding scenarios that trigger the AB/BA deadlock. This may involve modifying the code or configuration to prevent simultaneous access to the pci_dev_lock() and sriov_numvfs_store() functions in a way that could lead to the deadlock. However, implementing workarounds can be complex and may introduce other potential issues, so it is generally recommended to apply the official fix provided by updating the Kernel to the patched version.
Conclusion
The identified vulnerability in the Kernel related to the AB/BA deadlock scenario with the pci_dev_lock() and sriov_numvfs_store() functions can potentially lead to system instability and crashes. It is crucial to update the Kernel to version v5.18.3 or later to mitigate this vulnerability. Applying the official fix provided by the Linux Kernel developers is the recommended approach. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel is a critical component of the Linux operating system that manages the communication between hardware and software. It provides essential services and functions to enable the proper functioning of the system.
A deadlock is a situation where two or more processes or threads are unable to proceed because each is waiting for the other to release a resource. This can result in a system freeze or unresponsiveness.
The vulnerability can lead to system instability or crashes, impacting the availability and reliability of the system. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) condition or disrupt the normal operation of the system.
No, the impact and attack plausibility of this vulnerability have not been proven. It is an automated ID intended to aid in the discovery of potential security vulnerabilities.
To fix this vulnerability, it is recommended to update the Kernel to version v5.18.3 or later. This can be done by obtaining the updated Kernel source code from the official Linux Kernel repository and following the provided instructions for building and installing the Kernel.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
