Executive brief
A vulnerability was identified in the Linux kernel's synchronization mechanism used for managing shared memory buffers. An error in how the system handles internal locking could lead to inconsistent system states or crashes. This primarily affects system stability and could be used by a local attacker to cause a denial-of-service condition.
Technical details
The vulnerability is a CWE-667 (Improper Locking) issue within the dma-buf/sw-sync driver. A previous commit incorrectly replaced spin_unlock_irqrestore() with spin_unlock_irq() in both sync_debugfs_show() and sync_print_obj(). Because sync_print_obj() is called from sync_debugfs_show(), which already manages interrupt states, this results in an inconsistent lock state and triggers lockdep warnings. A local attacker with access to debugfs could potentially exploit this to cause a kernel panic or system instability. The issue has been resolved by using plain spin_lock/unlock in the nested sync_print_obj() function.
Affected products
- Linux Linux Kernel up to (excluding) 4.14, 4.19 to (excluding) 4.19.316, 5.4 to (excluding) 5.4.278, 5.10 to (excluding) 5.10.219, 5.15 to (excluding) 5.15.161, 6.1 to (excluding) 6.1.93, 6.6 to (excluding) 6.6.33, 6.9 to (excluding) 6.9.4
Timeline
- 2024-06-21: disclosed
- 2024-06-21: advisory
References
- https://git.kernel.org/stable/c/165b25e3ee9333f7b04f8db43895beacb51582ed
- https://git.kernel.org/stable/c/1ff116f68560a25656933d5a18e7619cb6773d8a
- https://git.kernel.org/stable/c/242b30466879e6defa521573c27e12018276c33a
- https://git.kernel.org/stable/c/8a283cdfc8beeb14024387a925247b563d614e1e
- https://git.kernel.org/stable/c/9d75fab2c14a25553a1664586ed122c316bd1878
- https://git.kernel.org/stable/c/a4ee78244445ab73af22bfc5a5fc543963b25aef
- https://git.kernel.org/stable/c/ae6fc4e6a3322f6d1c8ff59150d8469487a73dd8