| { |
| "containers": { |
| "cna": { |
| "providerMetadata": { |
| "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" |
| }, |
| "descriptions": [ |
| { |
| "lang": "en", |
| "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: Fix uevent_show() vs driver detach race\n\nuevent_show() wants to de-reference dev->driver->name. There is no clean\nway for a device attribute to de-reference dev->driver unless that\nattribute is defined via (struct device_driver).dev_groups. Instead, the\nanti-pattern of taking the device_lock() in the attribute handler risks\ndeadlocks with code paths that remove device attributes while holding\nthe lock.\n\nThis deadlock is typically invisible to lockdep given the device_lock()\nis marked lockdep_set_novalidate_class(), but some subsystems allocate a\nlocal lockdep key for @dev->mutex to reveal reports of the form:\n\n ======================================================\n WARNING: possible circular locking dependency detected\n 6.10.0-rc7+ #275 Tainted: G OE N\n ------------------------------------------------------\n modprobe/2374 is trying to acquire lock:\n ffff8c2270070de0 (kn->active#6){++++}-{0:0}, at: __kernfs_remove+0xde/0x220\n\n but task is already holding lock:\n ffff8c22016e88f8 (&cxl_root_key){+.+.}-{3:3}, at: device_release_driver_internal+0x39/0x210\n\n which lock already depends on the new lock.\n\n the existing dependency chain (in reverse order) is:\n\n -> #1 (&cxl_root_key){+.+.}-{3:3}:\n __mutex_lock+0x99/0xc30\n uevent_show+0xac/0x130\n dev_attr_show+0x18/0x40\n sysfs_kf_seq_show+0xac/0xf0\n seq_read_iter+0x110/0x450\n vfs_read+0x25b/0x340\n ksys_read+0x67/0xf0\n do_syscall_64+0x75/0x190\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n -> #0 (kn->active#6){++++}-{0:0}:\n __lock_acquire+0x121a/0x1fa0\n lock_acquire+0xd6/0x2e0\n kernfs_drain+0x1e9/0x200\n __kernfs_remove+0xde/0x220\n kernfs_remove_by_name_ns+0x5e/0xa0\n device_del+0x168/0x410\n device_unregister+0x13/0x60\n devres_release_all+0xb8/0x110\n device_unbind_cleanup+0xe/0x70\n device_release_driver_internal+0x1c7/0x210\n driver_detach+0x47/0x90\n bus_remove_driver+0x6c/0xf0\n cxl_acpi_exit+0xc/0x11 [cxl_acpi]\n __do_sys_delete_module.isra.0+0x181/0x260\n do_syscall_64+0x75/0x190\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe observation though is that driver objects are typically much longer\nlived than device objects. It is reasonable to perform lockless\nde-reference of a @driver pointer even if it is racing detach from a\ndevice. Given the infrequency of driver unregistration, use\nsynchronize_rcu() in module_remove_driver() to close any potential\nraces. It is potentially overkill to suffer synchronize_rcu() just to\nhandle the rare module removal racing uevent_show() event.\n\nThanks to Tetsuo Handa for the debug analysis of the syzbot report [1]." |
| } |
| ], |
| "affected": [ |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "unaffected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "drivers/base/core.c", |
| "drivers/base/module.c" |
| ], |
| "versions": [ |
| { |
| "version": "bb3641a58317", |
| "lessThan": "49ea4e0d8626", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "bb3641a58317", |
| "lessThan": "fe10c8367687", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "13d25e82b6d0", |
| "lessThan": "dd98c9630b7e", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "13d25e82b6d0", |
| "lessThan": "d4dba9a07683", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "760603e30bf1", |
| "lessThan": "f098e8fc7227", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "760603e30bf1", |
| "lessThan": "1cfc32930461", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "ec772ed7cb21", |
| "lessThan": "9c23fc327d6e", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "ec772ed7cb21", |
| "lessThan": "4749d336170d", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "08891eeaa97c", |
| "lessThan": "4a7c2a838752", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "08891eeaa97c", |
| "lessThan": "92d847a35e1e", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "a42b0060d6ff", |
| "lessThan": "4d035c743c3e", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "a42b0060d6ff", |
| "lessThan": "fd28d9589460", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "c0a40097f0bc", |
| "lessThan": "cd490a247ddf", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "c0a40097f0bc", |
| "lessThan": "15fffc6a5624", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "c0a40097f0bc", |
| "lessThan": "cfc72b86fa20", |
| "status": "affected", |
| "versionType": "git" |
| } |
| ] |
| }, |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "affected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "drivers/base/core.c", |
| "drivers/base/module.c" |
| ], |
| "versions": [ |
| { |
| "version": "6.10", |
| "status": "affected" |
| }, |
| { |
| "version": "0", |
| "lessThan": "6.10", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "4.19.320", |
| "lessThanOrEqual": "4.19.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "4.19.323", |
| "lessThanOrEqual": "4.19.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.4.282", |
| "lessThanOrEqual": "5.4.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.4.285", |
| "lessThanOrEqual": "5.4.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.10.224", |
| "lessThanOrEqual": "5.10.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.10.229", |
| "lessThanOrEqual": "5.10.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.15.165", |
| "lessThanOrEqual": "5.15.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.15.171", |
| "lessThanOrEqual": "5.15.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.1.105", |
| "lessThanOrEqual": "6.1.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.1.116", |
| "lessThanOrEqual": "6.1.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.6.46", |
| "lessThanOrEqual": "6.6.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.6.60", |
| "lessThanOrEqual": "6.6.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.10.5", |
| "lessThanOrEqual": "6.10.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.11", |
| "lessThanOrEqual": "*", |
| "status": "unaffected", |
| "versionType": "original_commit_for_fix" |
| }, |
| { |
| "version": "6.11.7", |
| "lessThanOrEqual": "6.11.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| } |
| ] |
| } |
| ], |
| "references": [ |
| { |
| "url": "https://git.kernel.org/stable/c/49ea4e0d862632d51667da5e7a9c88a560e9c5a1" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/fe10c8367687c27172a10ba5cc849bd82077bd7d" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/dd98c9630b7ee273da87e9a244f94ddf947161e2" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/d4dba9a076838f3d0333a6a66efec2cdda90b2ee" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/f098e8fc7227166206256c18d56ab622039108b1" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/1cfc329304617838dc06f021bbbde3bc79cd655e" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/9c23fc327d6ec67629b4ad323bd64d3834c0417d" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/4749d336170dbb629e515a857e58a82e61c37a9c" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/4a7c2a8387524942171037e70b80e969c3b5c05b" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/92d847a35e1e41bceba13b8ac1f0e1b9dbe30d25" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/4d035c743c3e391728a6f81cbf0f7f9ca700cf62" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/fd28d9589460945985ef5333e9b942c4261f0826" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/cd490a247ddf325325fd0de8898659400c9237ef" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/15fffc6a5624b13b428bb1c6e9088e32a55eb82c" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/cfc72b86fa20cbf44d2b6cc27b35eb15080232ab" |
| } |
| ], |
| "title": "driver core: Fix uevent_show() vs driver detach race", |
| "x_generator": { |
| "engine": "bippy-9e1c9544281a" |
| } |
| } |
| }, |
| "cveMetadata": { |
| "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", |
| "cveID": "CVE-2024-44952", |
| "requesterUserId": "gregkh@kernel.org", |
| "serial": "1", |
| "state": "PUBLISHED" |
| }, |
| "dataType": "CVE_RECORD", |
| "dataVersion": "5.0" |
| } |
