CVE-2024-36924: linux-libc-dev - kernel: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
Summary
CVE-2024-36924: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() lpfc_worker_wake_up() calls the lpfc_work_done() routine, which takes the hbalock. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package in the Linux kernel that provides the C library headers for the kernel. It is used by developers to compile and build applications that interact with the kernel. The vulnerability in this package affects the lpfc (LightPulse Fibre Channel) driver, which is responsible for handling SCSI commands over Fibre Channel connections. The vulnerability arises from a flaw in the lpfc_worker_wake_up() function, which is called while holding the hbalock. This can lead to potential deadlock scenarios.
Vulnerability Detail
The vulnerability in the linux-libc-dev package arises from the improper handling of the hbalock in the lpfc_worker_wake_up() function. When this function is called, it acquires the hbalock, which can potentially cause a deadlock if lpfc_work_done() is subsequently called. An attacker could exploit this vulnerability to cause a denial of service (DoS) condition or potentially execute arbitrary code. The severity of this vulnerability is rated as MEDIUM with a CVSS score of 5.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The linux-libc-dev package is vulnerable to a flaw in the lpfc_worker_wake_up() function, which can lead to potential deadlock scenarios. It is important to update the package to version 6.1.90-1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package in the Linux kernel that provides the C library headers for the kernel. It is used by developers to compile and build applications that interact with the kernel.
lpfc (LightPulse Fibre Channel) is a driver in the Linux kernel responsible for handling SCSI commands over Fibre Channel connections.
The vulnerability can lead to potential deadlock scenarios, causing a denial of service (DoS) condition or potentially allowing an attacker to execute arbitrary code.
The severity of this vulnerability is rated as MEDIUM with a CVSS score of 5.5.
To fix this vulnerability, it is recommended to update the linux-libc-dev package to version 6.1.90-1 or later using the package manager of your Linux distribution.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
