CVE-2024-27009: s390/cio: fix race condition during online processing
In the Linux kernel, the following vulnerability has been resolved:
s390/cio: fix race condition during online processing
A race condition exists in ccwdevicesetonline() that can cause the online process to fail, leaving the affected device in an inconsistent state. As a result, subsequent attempts to set that device online fail with return code ENODEV.
The problem occurs when a path verification request arrives after a wait for final device state completed, but before the result state is evaluated.
Fix this by ensuring that the CCW-device lock is held between determining final state and checking result state.
Note that since:
commit 2297791c92d0 ("s390/cio: dont unregister subchannel from child-drivers")
path verification requests are much more likely to occur during boot, resulting in an increased chance of this race condition occurring.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27009?
CVE-2024-27009 is assessed as having moderate severity due to the risk of inconsistent device states.
How do I fix CVE-2024-27009?
To remediate CVE-2024-27009, update to the patched kernel versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
What platforms are affected by CVE-2024-27009?
CVE-2024-27009 affects systems running vulnerable versions of the Linux kernel, particularly on s390 architecture.
What problems does CVE-2024-27009 cause?
CVE-2024-27009 can lead to race conditions that prevent devices from transitioning to an online state correctly.
Is CVE-2024-27009 a zero-day vulnerability?
CVE-2024-27009 is not classified as a zero-day vulnerability, as it has been publicly disclosed and patches are available.