CVE-2024-26769: Vulnerability in linux-libc-dev package - Deadlock on delete association path
Summary
CVE-2024-26769: In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: avoid deadlock on delete association path When deleting an association the shutdown path is deadlocking because we try to flush the nvmet_wq n... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling C programs that use the Linux kernel interfaces. It is an essential component for building and running applications on Linux systems. The package is widely used and is included in various Linux distributions.
This vulnerability (CVE-2024-26769) affects the linux-libc-dev package, specifically in the nvmet-fc component. The nvmet-fc module is responsible for handling Fibre Channel transport for the NVMe over Fabrics (NVMe-oF) subsystem. NVMe-oF allows remote access to NVMe storage devices over a network.
The vulnerability arises when deleting an association, causing a deadlock in the shutdown path. This deadlock occurs due to an attempt to flush the nvmet_wq nested. However, this issue has been addressed in the latest version of the package.
Vulnerability Detail
The vulnerability (CVE-2024-26769) in the linux-libc-dev package's nvmet-fc component can lead to a deadlock when deleting an association. This deadlock occurs during the shutdown process, where an attempt to flush the nvmet_wq nested causes the system to deadlock. The vulnerability can impact systems utilizing NVMe-oF for remote access to NVMe storage devices over a Fibre Channel network.
The ramifications of this vulnerability include potential system crashes, unresponsiveness, and disruption of storage operations. It can lead to service interruptions and data loss.
The vulnerability has a CVSS score of 4.4, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is recommended to apply the available fix by updating the linux-libc-dev package to the latest version.
Conclusion
The vulnerability (CVE-2024-26769) in the linux-libc-dev package's nvmet-fc component can cause a deadlock on the delete association path. It is crucial to update the linux-libc-dev package to version 6.1.90-1 or later to mitigate this vulnerability. Applying the fix will help prevent system crashes, unresponsiveness, and potential data loss. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling C programs that use the Linux kernel interfaces.
The nvmet-fc component is responsible for handling Fibre Channel transport for the NVMe over Fabrics (NVMe-oF) subsystem. NVMe-oF allows remote access to NVMe storage devices over a network.
NVMe-oF (NVMe over Fabrics) is a technology that enables remote access to NVMe storage devices over a network, such as Fibre Channel or Ethernet.
The vulnerability can lead to system crashes, unresponsiveness, and disruption of storage operations. It may result in service interruptions and data loss.
The CVSS score of this vulnerability is 4.4, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
