CVE-2024-26623: pds_core: Prevent race issues involving the adminq

Published Mar 6, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

pdscore: Prevent race issues involving the adminq

There are multiple paths that can result in using the pdsc's adminq.

[1] pdscadminqisr and the resulting work from queuework(), i.e. pdscworkthread()->pdscprocessadminq()

[2] pdscadminqpost()

When the device goes through reset via PCIe reset and/or a fwdown/fwup cycle due to bad PCIe state or bad device state the adminq is destroyed and recreated.

A NULL pointer dereference can happen if [1] or [2] happens after the adminq is already destroyed.

In order to fix this, add some further state checks and implement reference counting for adminq uses. Reference counting was used because multiple threads can attempt to access the adminq at the same time via [1] or [2]. Additionally, multiple clients (i.e. pds-vfio-pci) can be using [2] at the same time.

The adminqrefcnt is initialized to 1 when the adminq has been allocated and is ready to use. Users/clients of the adminq (i.e. [1] and [2]) will increment the refcnt when they are using the adminq. When the driver goes into a fwdown cycle it will set the PDSCSFWDEAD bit and then wait for the adminqrefcnt to hit 1. Setting the PDSCSFWDEAD before waiting will prevent any further adminqrefcnt increments. Waiting for the adminqrefcnt to hit 1 allows for any current users of the adminq to finish before the driver frees the adminq. Once the adminqrefcnt hits 1 the driver clears the refcnt to signify that the adminq is deleted and cannot be used. On the fwup cycle the driver will once again initialize the adminqrefcnt to 1 allowing the adminq to be used again.

Affected Software

7 affected componentsFixes available
Linux Linux kernel>=6.4<6.6.16
Linux Linux kernel>=6.7<6.7.4
Linux Linux kernel=6.8-rc1
Linux Linux kernel=6.8-rc2
debian/linux<6.7.7-1
6.7.7-1
debian/linux<6.7.7-1
6.7.7-1
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1

Event History

Mar 6, 2024
CVE Published
via MITRE·06:45 AM
Data Sourced
via MITRE·06:45 AM
DescriptionSeverity
Data Sourced
via NVD·07:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·07:15 AM
DescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2024-26623?

CVE-2024-26623 has been classified with a medium severity level.

2

How do I fix CVE-2024-26623?

To fix CVE-2024-26623, update your Linux kernel to one of the following versions: 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.

3

Which systems are affected by CVE-2024-26623?

CVE-2024-26623 affects Debian systems running the specified vulnerable versions of the Linux kernel.

4

What components of the Linux kernel are involved in CVE-2024-26623?

CVE-2024-26623 involves issues in the pds_core component related to race conditions with the admin queue.

5

Is there any information available on the fix for CVE-2024-26623?

Yes, detailed information regarding the resolution of CVE-2024-26623 can be found in the corresponding kernel commits.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203