REDHAT-BUG-2383432: Medium severity Linux Foundation Linux Kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using
Running IDXD workloads in a container with the /dev directory mounted can trigger a call trace or even a kernel panic when the parent process of the container is terminated.
This issue occurs because, under certain configurations, Docker does not properly propagate the mount replica back to the original mount point.
In this case, when the user driver detaches, the WQ is destroyed but it still calls destroyworkqueue() attempting to completes all pending work. It's necessary to check wq->wq and skip the drain if it no longer exists.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2383432?
The severity of REDHAT-BUG-2383432 is considered high due to the possibility of triggering a kernel panic.
How do I fix REDHAT-BUG-2383432?
To fix REDHAT-BUG-2383432, ensure that the workqueue allocated by the idxd wq driver is checked for availability before use.
What systems are affected by REDHAT-BUG-2383432?
REDHAT-BUG-2383432 affects systems running the Linux Kernel that utilize the dmaengine and idxd workload in containers.
What type of vulnerability is REDHAT-BUG-2383432?
REDHAT-BUG-2383432 is a kernel vulnerability related to improper checks in the dmaengine framework.
Is there a workaround for REDHAT-BUG-2383432?
As a workaround for REDHAT-BUG-2383432, avoid mounting the /dev directory when running IDXD workloads in containers.