CVE-2024-27005: interconnect: Don't access req_list while it's being manipulated
In the Linux kernel, the following vulnerability has been resolved:
interconnect: Don't access reqlist while it's being manipulated
The icclock mutex was split into separate icclock and iccbwlock mutexes in [1] to avoid lockdep splats. However, this didn't adequately protect access to iccnode::reqlist.
The iccsetbw() function will eventually iterate over reqlist while only holding iccbwlock, but reqlist can be modified while only holding icclock. This causes races between iccsetbw(), oficcget(), and iccput().
Example A:
CPU0 CPU1 ---- ---- iccsetbw(patha) mutexlock(&iccbwlock); iccput(pathb) mutexlock(&icclock); aggregaterequests() hlistforeachentry(r, ... hlistdel(... <r = invalid pointer>
Example B:
CPU0 CPU1 ---- ---- iccsetbw(patha) mutexlock(&iccbwlock); pathb = oficcget() oficcgetbyindex() mutexlock(&icclock); pathfind() pathinit() aggregaterequests() hlistforeachentry(r, ... hlistaddhead(... <r = invalid pointer>
Fix this by ensuring iccbwlock is always held before manipulating iccnode::reqlist. The additional places iccbwlock is held don't perform any memory allocations, so we should still be safe from the original lockdep splats that motivated the separate locks.
[1] commit af42269c3523 ("interconnect: Fix locking for runpm vs reclaim")
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.35.1-1 - Upgrade
Upgrade
Linux kernel interconnectto a version that resolves this vulnerability.Patch commit af42269c3523 - Configuration
Apply the resolution for the interconnect locking issue: ensure req_list is not accessed while it is being manipulated by enforcing that icc_bw_lock is always held before manipulating icc_node::req_list. (This is addressed by splitting icc_lock into icc_lock and icc_bw_lock and adjusting access patterns so icc_set_bw() does not iterate over req_list while only holding icc_bw_lock.)
Linux kernel interconnect code (icc_set_bw / req_list access) Lock ordering for req_list manipulation = Always hold icc_bw_lock before manipulating icc_node::req_list; avoid accessing req_list while it is being manipulated
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27005?
CVE-2024-27005 is classified as a high-severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-27005?
To fix CVE-2024-27005, update your Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.12.10-1, or 6.12.11-1.
Which versions of the Linux kernel are affected by CVE-2024-27005?
The affected versions of the Linux kernel for CVE-2024-27005 are up to and including 6.1.123-1 and 6.1.119-1.
What components are involved in CVE-2024-27005?
CVE-2024-27005 involves issues with the icc_lock and icc_bw_lock mutexes in the interconnect functionality.
Is CVE-2024-27005 exploitable remotely?
The details on whether CVE-2024-27005 can be exploited remotely are not specified, but it typically requires local access.