CVE-2024-26691: linux-libc-dev - Fix circular locking dependency
Summary
CVE-2024-26691: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix circular locking dependency The rule inside kvm enforces that the vcpu->mutex is taken *inside* kvm->lock. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling programs that use the Linux kernel interfaces. It is an essential component for building and running applications on Linux systems. The vulnerability identified as CVE-2024-26691 affects the linux-libc-dev package, specifically in the KVM (Kernel-based Virtual Machine) module for the arm64 architecture.
Vulnerability Detail
The vulnerability in the linux-libc-dev package arises from a circular locking dependency issue in the KVM module for arm64. The KVM module enforces a rule that the vcpu->mutex lock must be acquired inside the kvm->lock. However, the pkvm_create_hyp_vm() function violates this rule by acquiring the kvm->lock while already holding the vcpu->mutex lock from kvm_vcpu_ioctl(). This circular locking dependency can lead to potential issues and instability in the hypervisor environment. The vulnerability has been addressed by protecting the hypervisor VM handle with the config_lock, similar to other forms of VM-scoped data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the recommended fix by updating the linux-libc-dev package to the latest version.
Conclusion
The vulnerability in the linux-libc-dev package has been addressed by fixing the circular locking dependency issue in the KVM module for arm64. It is crucial to update the linux-libc-dev package to version 6.1.90-1 or later to mitigate the vulnerability. For further assistance or support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package provides the necessary header files and libraries for compiling programs that use the Linux kernel interfaces. It is an essential component for building and running applications on Linux systems.
KVM (Kernel-based Virtual Machine) is a virtualization module in the Linux kernel that allows running virtual machines on a host system. It provides hardware-assisted virtualization for various architectures, including arm64.
A circular locking dependency occurs when two or more locks are acquired in a way that creates a circular chain of dependencies. This can lead to deadlocks and other synchronization issues in multi-threaded or multi-process environments.
The circular locking dependency vulnerability in the linux-libc-dev package can result in instability and potential issues in the hypervisor environment. It may lead to unexpected behavior, crashes, or denial of service.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package manifest file (e.g., package-lock.json) and Vulert will analyze it in real-time to identify any open-source vulnerabilities, including CVE-2024-26691.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
