PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() in Kernel
Summary
GSD-2022-1003352: PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store(). Affects Kernel versions < 2cdd5284035322795b0964f899eefba254cfe483. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages communication between hardware and software. It provides essential functions and services to enable the proper functioning of the system. The vulnerability identified in the Kernel relates to the handling of the pci_dev_lock() function in conjunction with the sriov_numvfs_store() function. This vulnerability can potentially lead to a deadlock situation, impacting the stability and performance of the system.
Vulnerability Detail
The vulnerability arises from a deadlock scenario caused by the AB/BA locking pattern when accessing the pci_dev_lock() function and the sriov_numvfs_store() function. This deadlock can occur when multiple threads or processes attempt to acquire these locks in a specific order, leading to a situation where each thread is waiting for the other to release the lock, resulting in a deadlock. This vulnerability can be exploited by an attacker to cause a denial-of-service condition or disrupt the normal operation of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As this vulnerability is fixed in the latest version of the Kernel, applying the update is the recommended solution. However, if updating is not immediately feasible, a potential workaround could involve modifying the code to avoid the AB/BA locking pattern when accessing the pci_dev_lock() and sriov_numvfs_store() functions. This workaround would require a thorough understanding of the codebase and careful modification to ensure the avoidance of the deadlock scenario.
Conclusion
The identified vulnerability in the Kernel related to the pci_dev_lock() and sriov_numvfs_store() functions can lead to a deadlock scenario, impacting the stability and performance of the system. It is crucial to update the Kernel to version v5.15.46 or later to mitigate this vulnerability. Alternatively, a workaround involving code modification can be implemented. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to a deadlock situation, potentially causing a denial-of-service condition or disrupting the normal operation of the system.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
At the time of this report, there is no known exploit for this vulnerability. However, it is important to apply the recommended fix or workaround to mitigate the risk.
This vulnerability requires local access to the system to exploit. However, an attacker with local access can potentially leverage this vulnerability to disrupt the system's operation.
This vulnerability is specific to the Linux Kernel and does not have any additional dependencies or prerequisites.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
