CVE-2024-40904: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
In the Linux kernel, the following vulnerability has been resolved:
USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages
The syzbot fuzzer found that the interrupt-URB completion callback in the cdc-wdm driver was taking too long, and the driver's immediate resubmission of interrupt URBs with -EPROTO status combined with the dummy-hcd emulation to cause a CPU lockup:
cdcwdm 1-1:1.0: nonzero urb status received: -71 cdcwdm 1-1:1.0: wdmintcallback - 0 bytes watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [syz-executor782:6625] CPU#0 Utilization every 4s during lockup: #1: 98% system, 0% softirq, 3% hardirq, 0% idle #2: 98% system, 0% softirq, 3% hardirq, 0% idle #3: 98% system, 0% softirq, 3% hardirq, 0% idle #4: 98% system, 0% softirq, 3% hardirq, 0% idle #5: 98% system, 1% softirq, 3% hardirq, 0% idle Modules linked in: irq event stamp: 73096 hardirqs last enabled at (73095): [<ffff80008037bc00>] consoleemitnextrecord kernel/printk/printk.c:2935 [inline] hardirqs last enabled at (73095): [<ffff80008037bc00>] consoleflushall+0x650/0xb74 kernel/printk/printk.c:2994 hardirqs last disabled at (73096): [<ffff80008af10b00>] el1irq arch/arm64/kernel/entry-common.c:533 [inline] hardirqs last disabled at (73096): [<ffff80008af10b00>] el1interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 softirqs last enabled at (73048): [<ffff8000801ea530>] softirqhandleend kernel/softirq.c:400 [inline] softirqs last enabled at (73048): [<ffff8000801ea530>] handlesoftirqs+0xa60/0xc34 kernel/softirq.c:582 softirqs last disabled at (73043): [<ffff800080020de8>] dosoftirq+0x14/0x20 kernel/softirq.c:588 CPU: 0 PID: 6625 Comm: syz-executor782 Tainted: G W 6.10.0-rc2-syzkaller-g8867bbd4a056 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Testing showed that the problem did not occur if the two error messages -- the first two lines above -- were removed; apparently adding material to the kernel log takes a surprisingly large amount of time.
In any case, the best approach for preventing these lockups and to avoid spamming the log with thousands of error messages per second is to ratelimit the two deverr() calls. Therefore we replace them with deverrratelimited().
Other sources
Linux Kernel is vulnerable to a denial of service, caused by CPU lockup due to excessive log messages. A local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40904?
CVE-2024-40904 has been categorized as a moderate severity vulnerability in the Linux kernel relating to CPU lockup caused by excessive log messages.
How do I fix CVE-2024-40904?
To fix CVE-2024-40904, update your Linux kernel to version 4.19.317, 5.4.279, 5.10.221, 5.15.162, 6.1.95, or later versions as specified by your distribution.
Which systems are affected by CVE-2024-40904?
CVE-2024-40904 affects multiple versions of the Linux kernel, particularly those prior to the specified patched versions.
What component of the Linux kernel does CVE-2024-40904 affect?
CVE-2024-40904 specifically affects the cdc-wdm driver component of the Linux kernel.
Is there a workaround for CVE-2024-40904?
There is no documented workaround for CVE-2024-40904, and updating to a patched version is recommended for resolution.