Executive brief
A vulnerability in the Linux kernel's PCI bus management could allow a local user to cause a system crash or instability. The issue stems from improper locking when resetting hardware components connected via PCI, which can lead to unpredictable system behavior. This primarily impacts system availability and operational stability.
Technical details
A race condition exists in the Linux kernel PCI subsystem due to improper locking in the pci_bus_lock() function. While the function locked connected devices, it failed to lock the PCI bridge itself during secondary bus resets triggered via pci_reset_bus(). This missing bridge lock was identified via lockdep warnings in pci_bridge_secondary_bus_reset(). An attacker with local access could potentially exploit this synchronization issue to cause a kernel panic or hardware state corruption. The fix involves adding pci_dev_lock() for the bridge (bus->self) within the pci_bus_lock() and pci_bus_trylock() routines, while ensuring recursive locking deadlocks are avoided.
Affected products
- Linux Linux Kernel up to 4.19.322, 4.20 to 5.4.284, 5.5 to 5.10.226, 5.11 to 5.15.167, 5.16 to 6.1.110, 6.2 to 6.6.51, 6.7 to 6.10.10
Timeline
- 2024-05-30: other: Initial patch authored
- 2024-09-18: disclosed: CVE published
- 2024-09-12: patched: Patch committed to stable trees
References
- https://git.kernel.org/stable/c/04e85a3285b0e5c5af6fd2c0fd6e95ffecc01945
- https://git.kernel.org/stable/c/0790b89c7e911003b8c50ae50e3ac7645de1fae9
- https://git.kernel.org/stable/c/7253b4fed46471cc247c6cacefac890a8472c083
- https://git.kernel.org/stable/c/78c6e39fef5c428960aff742149bba302dd46f5a
- https://git.kernel.org/stable/c/81c68e218ab883dfa368460a59b674084c0240da
- https://git.kernel.org/stable/c/a4e772898f8bf2e7e1cf661a12c60a5612c4afab
- https://git.kernel.org/stable/c/df77a678c33871a6e4ac5b54a71662f1d702335b