CVE-2024-39282: net: wwan: t7xx: Fix FSM command timeout issue
In the Linux kernel, the following vulnerability has been resolved:
net: wwan: t7xx: Fix FSM command timeout issue
When driver processes the internal state change command, it use an asynchronous thread to process the command operation. If the main thread detects that the task has timed out, the asynchronous thread will panic when executing the completion notification because the main thread completion object has been released.
BUG: unable to handle page fault for address: fffffffffffffff8 PGD 1f283a067 P4D 1f283a067 PUD 1f283c067 PMD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:completeall+0x3e/0xa0 [...] Call Trace: <TASK> ? diebody+0x68/0xb0 ? pagefaultoops+0x379/0x3e0 ? excpagefault+0x69/0xa0 ? asmexcpagefault+0x22/0x30 ? completeall+0x3e/0xa0 fsmmainthread+0xa3/0x9c0 [mtkt7xx (HASH:1400 5)] ? pfxautoremovewakefunction+0x10/0x10 kthread+0xd8/0x110 ? pfxfsmmainthread+0x10/0x10 [mtkt7xx (HASH:1400 5)] ? pfxkthread+0x10/0x10 retfromfork+0x38/0x50 ? pfxkthread+0x10/0x10 retfromforkasm+0x1b/0x30 </TASK> [...] CR2: fffffffffffffff8 ---[ end trace 0000000000000000 ]---
Use the reference counter to ensure safe release as Sergey suggests: https://lore.kernel.org/all/da90f64c-260a-4329-87bf-1f9ff20a5951@gmail.com/
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39282?
CVE-2024-39282 has a medium severity rating due to its potential impact on system performance in the Linux kernel.
How do I fix CVE-2024-39282?
To fix CVE-2024-39282, update the Linux kernel to the latest version where the vulnerability has been patched.
What systems are affected by CVE-2024-39282?
CVE-2024-39282 affects the Linux kernel across various distributions that use the wwan t7xx driver.
What are the potential consequences of CVE-2024-39282?
The consequences of CVE-2024-39282 may include system instability or degraded performance due to command timeouts in network operations.
When was CVE-2024-39282 reported?
CVE-2024-39282 was reported and documented in 2024, highlighting an issue in the Linux kernel's handling of internal state changes.