CVE-2024-49927: x86/ioapic: Handle allocation failures gracefully
In the Linux kernel, the following vulnerability has been resolved:
x86/ioapic: Handle allocation failures gracefully
Breno observed panics when using failslab under certain conditions during runtime:
can not alloc irqpinlist (-1,0,20) Kernel panic - not syncing: IO-APIC: failed to add irq-pin. Can not proceed
panic+0x4e9/0x590 mpirqdomainalloc+0x9ab/0xa80 irqdomainallocirqslocked+0x25d/0x8d0 irqdomainallocirqs+0x80/0x110 mpmappintoirq+0x645/0x890 acpiregistergsiioapic+0xe6/0x150 hpetopen+0x313/0x480
That's a pointless panic which is a leftover of the historic IO/APIC code which panic'ed during early boot when the interrupt allocation failed.
The only place which might justify panic is the PIT/HPET timercheck() code which tries to figure out whether the timer interrupt is delivered through the IO/APIC. But that code does not require to handle interrupt allocation failures. If the interrupt cannot be allocated then timer delivery fails and it either panics due to that or falls back to legacy mode.
Cure this by removing the panic wrapper around addpintoirqnode() and making mpirqdomainalloc() aware of the failure condition and handle it as any other failure in this function gracefully.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49927?
The severity of CVE-2024-49927 is classified as high due to the potential for kernel panic and system stability issues.
How do I fix CVE-2024-49927?
To fix CVE-2024-49927, you should update your Linux kernel to a patched version such as 6.1.123-1 or higher.
Which Linux kernel versions are affected by CVE-2024-49927?
CVE-2024-49927 affects various versions of the Linux kernel prior to 5.15.168 and certain ranges in 5.16 to 6.6, 6.7 to 6.10, and 6.11.
What issues might arise from CVE-2024-49927 exploitation?
Exploitation of CVE-2024-49927 can lead to kernel panics and system instabilities, resulting in potential downtime.
Is there a known workaround for CVE-2024-49927?
Currently, the best workaround for CVE-2024-49927 is to update to a secure kernel version as no additional mitigations are reported.