PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() in Kernel
Summary
GSD-2022-1003869: PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store(). Affects Kernel versions < aed6d4d519210c28817948f34c53b6e058e0456c. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a fundamental component of the Linux operating system that provides core functionality and interfaces with hardware devices. It manages the communication between software and hardware, including the Peripheral Component Interconnect (PCI) bus. The PCI subsystem allows devices to be connected to a computer and enables the operating system to interact with them. This vulnerability specifically affects the Kernel's handling of the sriov_numvfs_store() function, which is responsible for configuring the number of Virtual Functions (VFs) for a SR-IOV (Single Root I/O Virtualization) device.
Vulnerability Detail
The vulnerability arises from a potential deadlock scenario involving the pci_dev_lock(). When multiple threads attempt to modify the number of VFs concurrently, a deadlock can occur due to inconsistent locking order. This can lead to a system freeze or crash, impacting the stability and availability of the affected system. The vulnerability has been addressed in Linux Kernel version v4.19.247 through the commit aed6d4d519210c28817948f34c53b6e058e0456c.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by updating the Linux Kernel to the recommended version.
Conclusion
In conclusion, the vulnerability in the Kernel's handling of sriov_numvfs_store() can lead to a deadlock scenario, resulting in system instability and potential crashes. It is crucial to update the Linux Kernel to version v4.19.247 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can result in a system freeze or crash, affecting the stability and availability of the affected system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities, including this one.
No, there is no known workaround for this vulnerability. It is crucial to update the Linux Kernel to the fixed version.
The fixed version of the Linux Kernel can be obtained from the official Linux Kernel repository at https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/.
Yes, you can wait for your Linux distribution to provide an updated package containing the fixed version of the Linux Kernel.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
