Lucene search

K
nvd416baaa9-dc9f-4396-8d5f-8c081fb06d67NVD:CVE-2024-42090
HistoryJul 29, 2024 - 5:15 p.m.

CVE-2024-42090

2024-07-2917:15:11
CWE-667
416baaa9-dc9f-4396-8d5f-8c081fb06d67
web.nvd.nist.gov
10
linux kernel
pinctrl
deadlock fix
cve-2024-42090
security vulnerability
synopsys
coverity static analysis

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0

Percentile

5.0%

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER

In create_pinctrl(), pinctrl_maps_mutex is acquired before calling
add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl()
calls pinctrl_free(). However, pinctrl_free() attempts to acquire
pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to
a potential deadlock.

This patch resolves the issue by releasing pinctrl_maps_mutex before
calling pinctrl_free(), preventing the deadlock.

This bug was discovered and resolved using Coverity Static Analysis
Security Testing (SAST) by Synopsys, Inc.

Affected configurations

Nvd
Node
linuxlinux_kernelRange3.104.19.317
OR
linuxlinux_kernelRange4.205.4.279
OR
linuxlinux_kernelRange5.55.10.221
OR
linuxlinux_kernelRange5.115.15.162
OR
linuxlinux_kernelRange5.166.1.97
OR
linuxlinux_kernelRange6.26.6.37
OR
linuxlinux_kernelRange6.76.9.8
VendorProductVersionCPE
linuxlinux_kernel*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0

Percentile

5.0%