CVE-2024-35819

Summary

In the Linux kernel, the following vulnerability has been resolved:

soc: fsl: qbman: Use raw spinlock for cgr_lock

smp_call_function always runs its callback in hard IRQ context, even on PREEMPT_RT, where spinlocks can sleep. So we need to use a raw spinlock for cgr_lock to ensure we aren't waiting on a sleeping task.

Although this bug has existed for a while, it was not apparent until commit ef2a8d5478b9 ("net: dpaa: Adjust queue depth on rate change") which invokes smp_call_function_single via qman_update_cgr_safe every time a link goes up or down.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux96f413f47677366e0ae03797409bfcc4151dbf9e < 2b3fede8225133671ce837c0d284804aa3bc7a02affected
LinuxLinux96f413f47677366e0ae03797409bfcc4151dbf9e < ff50716b7d5b7985979a5b21163cd79fb3d21d59affected
LinuxLinux96f413f47677366e0ae03797409bfcc4151dbf9e < 32edca2f03a6cc42c650ddc3ad83d086e3f365d1affected
LinuxLinux96f413f47677366e0ae03797409bfcc4151dbf9e < 9a3ca8292ce9fdcce122706c28c3f07bc857fe5eaffected
LinuxLinux96f413f47677366e0ae03797409bfcc4151dbf9e < d6b5aac451c9cc12e43ab7308e0e2ddc52c62c14affected
LinuxLinux96f413f47677366e0ae03797409bfcc4151dbf9e < 54d26adf64c04f186098b39dba86b86037084baaaffected
LinuxLinux96f413f47677366e0ae03797409bfcc4151dbf9e < f39d36b7540cf0088ed7ce2de2794f2aa237f6dfaffected
LinuxLinux96f413f47677366e0ae03797409bfcc4151dbf9e < cd53a8ae5aacb4ecd25088486dea1cd02e74b506affected
LinuxLinux96f413f47677366e0ae03797409bfcc4151dbf9e < fbec4e7fed89b579f2483041fabf9650fb0dd6bcaffected
LinuxLinuxa85c525bbff4d7467d7f0ab6fed8e2f787b073d6affected
LinuxLinux29cd9c2d1f428c281962135ea046a9d7bda88d14affected
LinuxLinux5b10a404419f0532ef3ba990c12bebe118adb6d7affected
LinuxLinux4.9.92 < 4.10affected
LinuxLinux4.14.32 < 4.15affected
LinuxLinux4.15.15 < 4.16affected
LinuxLinux4.16affected
LinuxLinux0 < 4.16unaffected
LinuxLinux4.19.312 <= 4.19.*unaffected
LinuxLinux5.4.274 <= 5.4.*unaffected
LinuxLinux5.10.215 <= 5.10.*unaffected
LinuxLinux5.15.154 <= 5.15.*unaffected
LinuxLinux6.1.84 <= 6.1.*unaffected
LinuxLinux6.6.24 <= 6.6.*unaffected
LinuxLinux6.7.12 <= 6.7.*unaffected
LinuxLinux6.8.3 <= 6.8.*unaffected
LinuxLinux6.9 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References