CVE-2024-41064: powerpc/eeh: avoid possible crash when edev->pdev changes
In the Linux kernel, the following vulnerability has been resolved:
powerpc/eeh: avoid possible crash when edev->pdev changes
If a PCI device is removed during eehpereportedev(), edev->pdev will change and can cause a crash, hold the PCI rescan/remove lock while taking a copy of edev->pdev->bus.
Other sources
Linux Kernel is vulnerable to a denial of service, caused by a flaw in Powerpc/Eeh. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41064?
CVE-2024-41064 has a high severity due to the potential for system crashes when a PCI device is removed during operation.
How do I fix CVE-2024-41064?
To fix CVE-2024-41064, update the Linux kernel to versions 5.4.281, 5.10.223, 5.15.164, 6.1.101, 6.6.42, or 6.9.11 as applicable.
Which systems are affected by CVE-2024-41064?
CVE-2024-41064 affects various versions of the Linux kernel, specifically those prior to the specified remedial versions.
What causes the issue described in CVE-2024-41064?
The issue in CVE-2024-41064 occurs when the PCI device is removed, leading to a change in the device pointer that can cause a system crash.
Is CVE-2024-41064 related to PCI device management?
Yes, CVE-2024-41064 is directly related to the management of PCI devices within the Linux kernel.