CVE-2024-42090: pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: fix deadlock in createpinctrl() when handling -EPROBEDEFER
In createpinctrl(), pinctrlmapsmutex is acquired before calling addsetting(). If addsetting() returns -EPROBEDEFER, createpinctrl() calls pinctrlfree(). However, pinctrlfree() attempts to acquire pinctrlmapsmutex, which is already held by createpinctrl(), leading to a potential deadlock.
This patch resolves the issue by releasing pinctrlmapsmutex before calling pinctrlfree(), preventing the deadlock.
This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc.
Other sources
Linux Kernel is vulnerable to a denial of service, caused by deadlock in createpinctrl() when handling -EPROBEDEFER. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42090?
CVE-2024-42090 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-42090?
To fix CVE-2024-42090, update to kernel versions 4.19.317, 5.4.279, 5.10.221, 5.15.162, 6.1.97, 6.6.37, 6.9.8, or 6.10 depending on your Linux distribution.
What systems are affected by CVE-2024-42090?
CVE-2024-42090 affects multiple versions of the Linux kernel from 3.10 up to but not including 4.19.317, and various release series after that.
What is the impact of CVE-2024-42090?
The impact of CVE-2024-42090 includes potential deadlock issues during the creation of pinctrl which can affect system stability.
When was CVE-2024-42090 resolved?
CVE-2024-42090 was resolved in recent updates to the Linux kernel, with specific fixes implemented in the new versions released by various distributions.