CVE-2024-45007: char: xillybus: Don't destroy workqueue from work item running on it
In the Linux kernel, the following vulnerability has been resolved:
char: xillybus: Don't destroy workqueue from work item running on it
Triggered by a kref decrement, destroyworkqueue() may be called from within a work item for destroying its own workqueue. This illegal situation is averted by adding a module-global workqueue for exclusive use of the offending work item. Other work items continue to be queued on per-device workqueues to ensure performance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
For the Linux kernel char/xillybus driver, add a module-global workqueue exclusively for the offending work item so it cannot destroy the per-device workqueue from a work item running on that same queue.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45007?
CVE-2024-45007 has a medium severity rating due to its potential for causing instability in the Linux kernel.
How do I fix CVE-2024-45007?
To fix CVE-2024-45007, you should upgrade to the appropriate version of the Linux kernel as specified in the remediation details.
What are the affected versions for CVE-2024-45007?
CVE-2024-45007 affects Linux kernel versions up to but not including 5.10.224-1 and certain specific versions listed in the remediation.
Is CVE-2024-45007 exploitable in production environments?
Yes, CVE-2024-45007 is exploitable in production environments, particularly where the vulnerable versions of the Linux kernel are in use.
What impact does CVE-2024-45007 have on system performance?
CVE-2024-45007 may lead to system instability and unexpected behavior due to illegal workqueue management.