CVE-2023-52498: PM: sleep: Fix possible deadlocks in core system-wide PM code
In the Linux kernel, the following vulnerability has been resolved:
PM: sleep: Fix possible deadlocks in core system-wide PM code
It is reported that in low-memory situations the system-wide resume core code deadlocks, because asyncscheduledev() executes its argument function synchronously if it cannot allocate memory (and not only in that case) and that function attempts to acquire a mutex that is already held. Executing the argument function synchronously from within dpmasyncfn() may also be problematic for ordering reasons (it may cause a consumer device's resume callback to be invoked before a requisite supplier device's one, for example).
Address this by changing the code in question to use asyncscheduledevnocall() for scheduling the asynchronous execution of device suspend and resume functions and to directly run them synchronously if asyncscheduledevnocall() returns false.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
PM: sleep: Fix possible deadlocks in core system-wide PM code
The Linux kernel CVE team has assigned CVE-2023-52498 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/20240229155245.1571576-39-lee@kernel.org/T/#u
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52498?
CVE-2023-52498 is considered a high-severity vulnerability due to its potential to cause deadlocks in critical system processes.
How do I fix CVE-2023-52498?
To mitigate CVE-2023-52498, update to a fixed version of the Linux kernel, such as 5.10.223-1 or 6.1.123-1.
What software is affected by CVE-2023-52498?
CVE-2023-52498 affects multiple versions of the Linux kernel, specifically versions below 5.10.210 and some between 5.11 to 6.1.76.
What can be the consequence of not fixing CVE-2023-52498?
Failing to address CVE-2023-52498 may result in system instability and the risk of critical applications being disrupted due to deadlocks.
Is there a workaround for CVE-2023-52498?
There are no specific workarounds recommended for CVE-2023-52498; updating the kernel is the primary solution.