CVE-2024-41080: io_uring: fix possible deadlock in io_register_iowq_max_workers()
In the Linux kernel, the following vulnerability has been resolved:
iouring: fix possible deadlock in ioregisteriowqmaxworkers()
The ioregisteriowqmaxworkers() function calls ioputsqdata(), which acquires the sqd->lock without releasing the uringlock. Similar to the commit 009ad9f0c6ee ("iouring: drop ctx->uringlock before acquiring sqd->lock"), this can lead to a potential deadlock situation.
To resolve this issue, the uringlock is released before calling ioputsqdata(), and then it is re-acquired after the function call.
This change ensures that the locks are acquired in the correct order, preventing the possibility of a deadlock.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41080?
The severity of CVE-2024-41080 is categorized as a moderate impact due to the potential for a deadlock in the Linux kernel.
How do I fix CVE-2024-41080?
To fix CVE-2024-41080, it is recommended to update to the latest patched versions of the Linux kernel provided by your distribution.
Which versions of the Linux kernel are affected by CVE-2024-41080?
CVE-2024-41080 affects Linux kernel versions prior to 5.10.226 and certain patched versions within the 6.1 series.
Is CVE-2024-41080 a remote exploit vulnerability?
CVE-2024-41080 is not considered a remote exploit vulnerability, as it primarily involves local conditions leading to a deadlock.
What is io_register_iowq_max_workers() in relation to CVE-2024-41080?
The function io_register_iowq_max_workers() is involved in the deadlock issue identified in CVE-2024-41080 within the Linux kernel's io_uring subsystem.