CVE-2024-35998: linux-libc-dev - Potential Deadlock in cifs_sync_mid_result
Summary
CVE-2024-35998: In the Linux kernel, the following vulnerability has been resolved: smb3: fix lock ordering potential deadlock in cifs_sync_mid_result Coverity spotted that the cifs_sync_mid_result function could deadlock "Thread deadlo... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package in the Debian operating system that provides the C library for Linux. It is a crucial component for running applications and interacting with the kernel. The linux-libc-dev package contains the header files and static libraries necessary for developing programs that directly interact with the Linux kernel. This vulnerability affects version 6.1.90-1 of the linux-libc-dev package.
Vulnerability Detail
The vulnerability, identified as CVE-2024-35998, is related to the smb3 module in the Linux kernel. The cifs_sync_mid_result function within this module had a potential deadlock issue. The function could acquire the TCP_Server_Info.srv_lock while holding the TCP_Server_Info.mid_lock, resulting in a lock ordering reversal. This deadlock could lead to a denial of service condition or other unexpected behavior in systems utilizing the affected version of the linux-libc-dev package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The vulnerability in the linux-libc-dev package, identified as CVE-2024-35998, could potentially lead to a deadlock situation and cause a denial of service or unexpected behavior. It is crucial to update the linux-libc-dev package to a patched version provided by the Debian Security Tracker. For further assistance and support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package in the Debian operating system that provides the C library for Linux. It is essential for running applications and interacting with the kernel.
The vulnerability could lead to a deadlock situation, potentially causing a denial of service or unexpected behavior in systems utilizing the affected version of the linux-libc-dev package.
To fix this vulnerability, it is recommended to update the linux-libc-dev package to a version that includes the necessary patch. The Debian Security Tracker provides updates and patches for the linux-libc-dev package.
No specific workaround has been mentioned for this vulnerability.
You can find more information about this vulnerability on the National Vulnerability Database (NVD) website or the Debian Security Tracker.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
