Fix deadlock in driver core's __device_attach in Linux Kernel
Summary
GSD-2022-1003532: driver core: fix deadlock in __device_attach. Affects Kernel versions >= 765230b5f084863183aa8adb3405ab3f32c0b16e, < 36ee9ffca8ef56c302f2855c4a5fccf61c0c1ada. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for hardware management, device drivers, and system resource allocation. The driver core is a fundamental component of the Linux Kernel responsible for managing device drivers and their interactions with devices. However, a vulnerability has been discovered in the __device_attach function of the driver core, leading to a potential deadlock.
Vulnerability Detail
The vulnerability arises from a deadlock situation in the __device_attach function of the driver core. A deadlock occurs when two or more threads are blocked indefinitely, waiting for each other to release resources. In this case, the deadlock can be triggered during device attachment, potentially causing system instability or crashes. The vulnerability was introduced in Linux Kernel version 4.2 and persists until version 5.10.122. It has been fixed in the Linux Kernel version 5.10.122 by commit 36ee9ffca8ef56c302f2855c4a5fccf61c0c1ada.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the fix by updating the Linux Kernel to the patched version.
Conclusion
The vulnerability in the driver core's __device_attach function of the Linux Kernel can lead to potential system instability or crashes. It is crucial to update the Linux Kernel to version 5.10.122 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The driver core is a crucial component of the Linux Kernel responsible for managing device drivers and their interactions with devices. It provides a framework for device discovery, driver registration, and device attachment/detachment.
A deadlock is a situation where two or more threads are blocked indefinitely, waiting for each other to release resources. This can lead to system instability or crashes.
The potential ramifications of this vulnerability include system instability, crashes, and potential denial-of-service scenarios if the deadlock occurs during critical operations.
This vulnerability affects Linux Kernel versions 4.2 to 5.10.121. It has been fixed in version 5.10.122.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will provide real-time alerts for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
