Lucene search

K
ubuntucveUbuntu.comUB:CVE-2024-26650
HistoryMar 26, 2024 - 12:00 a.m.

CVE-2024-26650

2024-03-2600:00:00
ubuntu.com
ubuntu.com
7
linux kernel
vulnerability
p2sb
resource handling
deadlock
pci device
probe
linux

6.5 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

In the Linux kernel, the following vulnerability has been resolved:
platform/x86: p2sb: Allow p2sb_bar() calls during PCI device probe
p2sb_bar() unhides P2SB device to get resources from the device. It guards
the operation by locking pci_rescan_remove_lock so that parallel rescans do
not find the P2SB device. However, this lock causes deadlock when PCI bus
rescan is triggered by /sys/bus/pci/rescan. The rescan locks
pci_rescan_remove_lock and probes PCI devices. When PCI devices call
p2sb_bar() during probe, it locks pci_rescan_remove_lock again. Hence the
deadlock. To avoid the deadlock, do not lock pci_rescan_remove_lock in
p2sb_bar(). Instead, do the lock at fs_initcall. Introduce
p2sb_cache_resources() for fs_initcall which gets and caches the P2SB
resources. At p2sb_bar(), refer the cache and return to the caller. Before
operating the device at P2SB DEVFN for resource cache, check that its
device class is PCI_CLASS_MEMORY_OTHER 0x0580 that PCH specifications
define. This avoids unexpected operation to other devices at the same
DEVFN. Tested-by Klara Modin <[email protected]>

Notes

Author Note
rodrigo-zaiden USN-6765-1 for linux-oem-6.5 wrongly stated that this CVE was fixed in version 6.5.0-1022.23. The mentioned notice was revoked and the state of the fix for linux-oem-6.5 was recovered to the previous state.

6.5 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%