CVE-2021-47469: spi: Fix deadlock when adding SPI controllers on SPI buses
First published: Wed May 22 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: spi: Fix deadlock when adding SPI controllers on SPI buses Currently we have a global spi_add_lock which we take when adding new devices so that we can check that we're not trying to reuse a chip select that's already controlled. This means that if the SPI device is itself a SPI controller and triggers the instantiation of further SPI devices we trigger a deadlock as we try to register and instantiate those devices while in the process of doing so for the parent controller and hence already holding the global spi_add_lock. Since we only care about concurrency within a single SPI bus move the lock to be per controller, avoiding the deadlock. This can be easily triggered in the case of spi-mux.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/6098475d4cb48d821bdf453c61118c56e26294f0
- https://git.kernel.org/stable/c/722ef19a161ce3fffb3d1b01ce2301c306639bdd
- https://launchpad.net/bugs/cve/CVE-2021-47469
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-47469
- https://nvd.nist.gov/vuln/detail/CVE-2021-47469
- https://security-tracker.debian.org/tracker/CVE-2021-47469
- https://ubuntu.com/security/CVE-2021-47469
Frequently Asked Questions
What is the severity of CVE-2021-47469?
CVE-2021-47469 is a vulnerability in the Linux kernel that could potentially lead to a deadlock when adding SPI controllers.
How do I fix CVE-2021-47469?
To fix CVE-2021-47469, you should upgrade to a patched version of the Linux kernel that resolves this deadlock issue.
Which versions of the Linux kernel are affected by CVE-2021-47469?
CVE-2021-47469 affects Linux kernel versions prior to 5.10.230, 5.14.15, and certain 5.15 release candidates.
Is CVE-2021-47469 a critical vulnerability?
The criticality of CVE-2021-47469 may depend on the specific system's use case and configuration, but it is important to address it to prevent potential deadlocks.
Where can I find more information on CVE-2021-47469?
Detailed information about CVE-2021-47469 can be found in official Linux kernel patches and security advisories.
- agent/title
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/weakness
- agent/remedy
- collector/launchpad-cve
- source/Launchpad
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/status
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- collector/nvd-cve
- collector/security-tracker-debian
- source/Debian
- agent/references
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- status/rejected
- vendor/linux
- canonical/linux kernel