5.5
MEDIUM
CVE-2024-44952
Apache Linux kernel Driver Core Device Locking Deadlock
Description
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
INFO
Published Date :
Sept. 4, 2024, 7:15 p.m.
Last Modified :
Nov. 9, 2024, 10:15 a.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-44952 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-44952 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Rejected by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 09, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 09, 2024
Action Type Old Value New Value Changed Description In the Linux kernel, the following vulnerability has been resolved: driver core: Fix uevent_show() vs driver detach race uevent_show() wants to de-reference dev->driver->name. There is no clean way for a device attribute to de-reference dev->driver unless that attribute is defined via (struct device_driver).dev_groups. Instead, the anti-pattern of taking the device_lock() in the attribute handler risks deadlocks with code paths that remove device attributes while holding the lock. This deadlock is typically invisible to lockdep given the device_lock() is marked lockdep_set_novalidate_class(), but some subsystems allocate a local lockdep key for @dev->mutex to reveal reports of the form: ====================================================== WARNING: possible circular locking dependency detected 6.10.0-rc7+ #275 Tainted: G OE N ------------------------------------------------------ modprobe/2374 is trying to acquire lock: ffff8c2270070de0 (kn->active#6){++++}-{0:0}, at: __kernfs_remove+0xde/0x220 but task is already holding lock: ffff8c22016e88f8 (&cxl_root_key){+.+.}-{3:3}, at: device_release_driver_internal+0x39/0x210 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&cxl_root_key){+.+.}-{3:3}: __mutex_lock+0x99/0xc30 uevent_show+0xac/0x130 dev_attr_show+0x18/0x40 sysfs_kf_seq_show+0xac/0xf0 seq_read_iter+0x110/0x450 vfs_read+0x25b/0x340 ksys_read+0x67/0xf0 do_syscall_64+0x75/0x190 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #0 (kn->active#6){++++}-{0:0}: __lock_acquire+0x121a/0x1fa0 lock_acquire+0xd6/0x2e0 kernfs_drain+0x1e9/0x200 __kernfs_remove+0xde/0x220 kernfs_remove_by_name_ns+0x5e/0xa0 device_del+0x168/0x410 device_unregister+0x13/0x60 devres_release_all+0xb8/0x110 device_unbind_cleanup+0xe/0x70 device_release_driver_internal+0x1c7/0x210 driver_detach+0x47/0x90 bus_remove_driver+0x6c/0xf0 cxl_acpi_exit+0xc/0x11 [cxl_acpi] __do_sys_delete_module.isra.0+0x181/0x260 do_syscall_64+0x75/0x190 entry_SYSCALL_64_after_hwframe+0x76/0x7e The observation though is that driver objects are typically much longer lived than device objects. It is reasonable to perform lockless de-reference of a @driver pointer even if it is racing detach from a device. Given the infrequency of driver unregistration, use synchronize_rcu() in module_remove_driver() to close any potential races. It is potentially overkill to suffer synchronize_rcu() just to handle the rare module removal racing uevent_show() event. Thanks to Tetsuo Handa for the debug analysis of the syzbot report [1]. Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Removed Reference kernel.org https://git.kernel.org/stable/c/49ea4e0d862632d51667da5e7a9c88a560e9c5a1 Removed Reference kernel.org https://git.kernel.org/stable/c/dd98c9630b7ee273da87e9a244f94ddf947161e2 Removed Reference kernel.org https://git.kernel.org/stable/c/f098e8fc7227166206256c18d56ab622039108b1 Removed Reference kernel.org https://git.kernel.org/stable/c/9c23fc327d6ec67629b4ad323bd64d3834c0417d Removed Reference kernel.org https://git.kernel.org/stable/c/4a7c2a8387524942171037e70b80e969c3b5c05b Removed Reference kernel.org https://git.kernel.org/stable/c/4d035c743c3e391728a6f81cbf0f7f9ca700cf62 Removed Reference kernel.org https://git.kernel.org/stable/c/cd490a247ddf325325fd0de8898659400c9237ef Removed Reference kernel.org https://git.kernel.org/stable/c/15fffc6a5624b13b428bb1c6e9088e32a55eb82c Removed Reference kernel.org https://git.kernel.org/stable/c/fe10c8367687c27172a10ba5cc849bd82077bd7d Removed Reference kernel.org https://git.kernel.org/stable/c/d4dba9a076838f3d0333a6a66efec2cdda90b2ee Removed Reference kernel.org https://git.kernel.org/stable/c/1cfc329304617838dc06f021bbbde3bc79cd655e Removed Reference kernel.org https://git.kernel.org/stable/c/4749d336170dbb629e515a857e58a82e61c37a9c Removed Reference kernel.org https://git.kernel.org/stable/c/92d847a35e1e41bceba13b8ac1f0e1b9dbe30d25 Removed Reference kernel.org https://git.kernel.org/stable/c/fd28d9589460945985ef5333e9b942c4261f0826 Removed Reference kernel.org https://git.kernel.org/stable/c/cfc72b86fa20cbf44d2b6cc27b35eb15080232ab Removed CWE NIST CWE-667 Removed CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Removed CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.10 from (excluding) 6.10.5 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.6.35 from (excluding) 6.6.46 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.95 from (excluding) 6.1.105 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.162 from (excluding) 5.15.165 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.10.221 from (excluding) 5.10.224 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.4.279 from (excluding) 5.4.282 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.19.317 from (excluding) 4.19.320 -
CVE Translated by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 09, 2024
Action Type Old Value New Value Removed Translation Title: kernel de Linux Description: En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: núcleo del controlador: se corrige uevent_show() frente a la ejecución de desconexión del controlador uevent_show() quiere desreferenciar dev->driver->name. No hay una forma clara de que un atributo de dispositivo desreferenciar dev->driver a menos que ese atributo se defina mediante (struct device_driver).dev_groups. En cambio, el antipatrón de tomar device_lock() en el controlador de atributos corre el riesgo de bloqueos con rutas de código que eliminan los atributos del dispositivo mientras mantienen el bloqueo. Este interbloqueo es típicamente invisible para lockdep dado que device_lock() está marcado como lockdep_set_novalidate_class(), pero algunos subsistemas asignan una clave lockdep local para que @dev->mutex revele informes del formato: ======================================================== ADVERTENCIA: posible dependencia de bloqueo circular detectada 6.10.0-rc7+ #275 Tainted: G OE N ------------------------------------------------------ modprobe/2374 está intentando adquirir el bloqueo: ffff8c2270070de0 (kn->active#6){++++}-{0:0}, en: __kernfs_remove+0xde/0x220 pero la tarea ya tiene el bloqueo: ffff8c22016e88f8 (&cxl_root_key){+.+.}-{3:3}, en: device_release_driver_internal+0x39/0x210 cuyo bloqueo ya depende del nuevo bloqueo. la cadena de dependencia existente (en orden inverso) es: -> #1 (&cxl_root_key){+.+.}-{3:3}: __mutex_lock+0x99/0xc30 uevent_show+0xac/0x130 dev_attr_show+0x18/0x40 sysfs_kf_seq_show+0xac/0xf0 seq_read_iter+0x110/0x450 vfs_read+0x25b/0x340 ksys_read+0x67/0xf0 do_syscall_64+0x75/0x190 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #0 (kn->active#6){++++}-{0:0}: __lock_acquire+0x121a/0x1fa0 lock_acquire+0xd6/0x2e0 kernfs_drain+0x1e9/0x200 __kernfs_remove+0xde/0x220 kernfs_remove_by_name_ns+0x5e/0xa0 device_del+0x168/0x410 device_unregister+0x13/0x60 devres_release_all+0xb8/0x110 device_unbind_cleanup+0xe/0x70 device_release_driver_internal+0x1c7/0x210 driver_detach+0x47/0x90 bus_remove_driver+0x6c/0xf0 cxl_acpi_exit+0xc/0x11 [cxl_acpi] __do_sys_delete_module.isra.0+0x181/0x260 do_syscall_64+0x75/0x190 entry_SYSCALL_64_after_hwframe+0x76/0x7e Sin embargo, la observación es que los objetos de controlador suelen tener una vida útil mucho más larga que los objetos de dispositivo. Es razonable realizar una desreferencia sin bloqueo de un puntero @driver incluso si está compitiendo por desconectarse de un dispositivo. Dada la poca frecuencia de anulación del registro de un controlador, usesynchronous_rcu() en module_remove_driver() para cerrar cualquier ejecución potencial. Es potencialmente excesivo sufrirsynchronous_rcu() solo para manejar el raro evento uevent_show() de ejecución de eliminación de módulo. Gracias a Tetsuo Handa por el análisis de depuración del informe de syzbot [1]. -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Nov. 08, 2024
Action Type Old Value New Value Added Reference kernel.org https://git.kernel.org/stable/c/fe10c8367687c27172a10ba5cc849bd82077bd7d [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/d4dba9a076838f3d0333a6a66efec2cdda90b2ee [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/1cfc329304617838dc06f021bbbde3bc79cd655e [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/4749d336170dbb629e515a857e58a82e61c37a9c [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/92d847a35e1e41bceba13b8ac1f0e1b9dbe30d25 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/fd28d9589460945985ef5333e9b942c4261f0826 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/cfc72b86fa20cbf44d2b6cc27b35eb15080232ab [No types assigned] -
Initial Analysis by [email protected]
Sep. 06, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Changed Reference Type https://git.kernel.org/stable/c/15fffc6a5624b13b428bb1c6e9088e32a55eb82c No Types Assigned https://git.kernel.org/stable/c/15fffc6a5624b13b428bb1c6e9088e32a55eb82c Patch Changed Reference Type https://git.kernel.org/stable/c/49ea4e0d862632d51667da5e7a9c88a560e9c5a1 No Types Assigned https://git.kernel.org/stable/c/49ea4e0d862632d51667da5e7a9c88a560e9c5a1 Patch Changed Reference Type https://git.kernel.org/stable/c/4a7c2a8387524942171037e70b80e969c3b5c05b No Types Assigned https://git.kernel.org/stable/c/4a7c2a8387524942171037e70b80e969c3b5c05b Patch Changed Reference Type https://git.kernel.org/stable/c/4d035c743c3e391728a6f81cbf0f7f9ca700cf62 No Types Assigned https://git.kernel.org/stable/c/4d035c743c3e391728a6f81cbf0f7f9ca700cf62 Patch Changed Reference Type https://git.kernel.org/stable/c/9c23fc327d6ec67629b4ad323bd64d3834c0417d No Types Assigned https://git.kernel.org/stable/c/9c23fc327d6ec67629b4ad323bd64d3834c0417d Patch Changed Reference Type https://git.kernel.org/stable/c/cd490a247ddf325325fd0de8898659400c9237ef No Types Assigned https://git.kernel.org/stable/c/cd490a247ddf325325fd0de8898659400c9237ef Patch Changed Reference Type https://git.kernel.org/stable/c/dd98c9630b7ee273da87e9a244f94ddf947161e2 No Types Assigned https://git.kernel.org/stable/c/dd98c9630b7ee273da87e9a244f94ddf947161e2 Patch Changed Reference Type https://git.kernel.org/stable/c/f098e8fc7227166206256c18d56ab622039108b1 No Types Assigned https://git.kernel.org/stable/c/f098e8fc7227166206256c18d56ab622039108b1 Patch Added CWE NIST CWE-667 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.19.317 up to (excluding) 4.19.320 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.4.279 up to (excluding) 5.4.282 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.10.221 up to (excluding) 5.10.224 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.162 up to (excluding) 5.15.165 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.95 up to (excluding) 6.1.105 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.6.35 up to (excluding) 6.6.46 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.10 up to (excluding) 6.10.5 *cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:* -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 04, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: driver core: Fix uevent_show() vs driver detach race uevent_show() wants to de-reference dev->driver->name. There is no clean way for a device attribute to de-reference dev->driver unless that attribute is defined via (struct device_driver).dev_groups. Instead, the anti-pattern of taking the device_lock() in the attribute handler risks deadlocks with code paths that remove device attributes while holding the lock. This deadlock is typically invisible to lockdep given the device_lock() is marked lockdep_set_novalidate_class(), but some subsystems allocate a local lockdep key for @dev->mutex to reveal reports of the form: ====================================================== WARNING: possible circular locking dependency detected 6.10.0-rc7+ #275 Tainted: G OE N ------------------------------------------------------ modprobe/2374 is trying to acquire lock: ffff8c2270070de0 (kn->active#6){++++}-{0:0}, at: __kernfs_remove+0xde/0x220 but task is already holding lock: ffff8c22016e88f8 (&cxl_root_key){+.+.}-{3:3}, at: device_release_driver_internal+0x39/0x210 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&cxl_root_key){+.+.}-{3:3}: __mutex_lock+0x99/0xc30 uevent_show+0xac/0x130 dev_attr_show+0x18/0x40 sysfs_kf_seq_show+0xac/0xf0 seq_read_iter+0x110/0x450 vfs_read+0x25b/0x340 ksys_read+0x67/0xf0 do_syscall_64+0x75/0x190 entry_SYSCALL_64_after_hwframe+0x76/0x7e -> #0 (kn->active#6){++++}-{0:0}: __lock_acquire+0x121a/0x1fa0 lock_acquire+0xd6/0x2e0 kernfs_drain+0x1e9/0x200 __kernfs_remove+0xde/0x220 kernfs_remove_by_name_ns+0x5e/0xa0 device_del+0x168/0x410 device_unregister+0x13/0x60 devres_release_all+0xb8/0x110 device_unbind_cleanup+0xe/0x70 device_release_driver_internal+0x1c7/0x210 driver_detach+0x47/0x90 bus_remove_driver+0x6c/0xf0 cxl_acpi_exit+0xc/0x11 [cxl_acpi] __do_sys_delete_module.isra.0+0x181/0x260 do_syscall_64+0x75/0x190 entry_SYSCALL_64_after_hwframe+0x76/0x7e The observation though is that driver objects are typically much longer lived than device objects. It is reasonable to perform lockless de-reference of a @driver pointer even if it is racing detach from a device. Given the infrequency of driver unregistration, use synchronize_rcu() in module_remove_driver() to close any potential races. It is potentially overkill to suffer synchronize_rcu() just to handle the rare module removal racing uevent_show() event. Thanks to Tetsuo Handa for the debug analysis of the syzbot report [1]. Added Reference kernel.org https://git.kernel.org/stable/c/49ea4e0d862632d51667da5e7a9c88a560e9c5a1 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/dd98c9630b7ee273da87e9a244f94ddf947161e2 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/f098e8fc7227166206256c18d56ab622039108b1 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/9c23fc327d6ec67629b4ad323bd64d3834c0417d [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/4a7c2a8387524942171037e70b80e969c3b5c05b [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/4d035c743c3e391728a6f81cbf0f7f9ca700cf62 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/cd490a247ddf325325fd0de8898659400c9237ef [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/15fffc6a5624b13b428bb1c6e9088e32a55eb82c [No types assigned]
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-44952 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-44952
weaknesses.
CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability