Executive brief
A vulnerability in the Linux kernel's pin control (pinctrl) subsystem could allow a local user to cause a system deadlock. This component manages how hardware pins are assigned to different functions on a processor. If triggered, the system may become unresponsive, leading to a denial of service.
Technical details
A deadlock exists in the create_pinctrl() function within drivers/pinctrl/core.c. The function acquires the pinctrl_maps_mutex before calling add_setting(). If add_setting() returns -EPROBE_DEFER, the code calls pinctrl_free() while still holding the mutex. Because pinctrl_free() also attempts to acquire the same pinctrl_maps_mutex, a recursive deadlock occurs. This is a local vulnerability (CWE-667) that can be triggered during device driver initialization. Patches have been released across multiple stable kernel branches to release the mutex before calling the free function.
Affected products
- Linux Linux Kernel 3.10 to 4.19.317, 4.20 to 5.4.279, 5.5 to 5.10.221, 5.11 to 5.15.162, 5.16 to 6.1.97, 6.2 to 6.6.37, 6.7 to 6.9.8
Timeline
- 2024-06-04: patched: Initial patch submitted by Amazon engineers
- 2024-07-29: disclosed: CVE published
References
- https://git.kernel.org/stable/c/01fe2f885f7813f8aed5d3704b384a97b1116a9e
- https://git.kernel.org/stable/c/4038c57bf61631219b31f1bd6e92106ec7f084dc
- https://git.kernel.org/stable/c/420ce1261907e5dbeda1e4daffd5b6c76f8188c0
- https://git.kernel.org/stable/c/48a7a7c9571c3e62f17012dd7f2063e926179ddd
- https://git.kernel.org/stable/c/adec57ff8e66aee632f3dd1f93787c13d112b7a1
- https://git.kernel.org/stable/c/b36efd2e3e22a329444b6b24fa48df6d20ae66e6
- https://git.kernel.org/stable/c/b813e3fd102a959c5b208ed68afe27e0137a561b