CVE-2023-52498

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

PM: sleep: Fix possible deadlocks in core system-wide PM code

It is reported that in low-memory situations the system-wide resume core

code deadlocks, because async_schedule_dev() executes its argument

function synchronously if it cannot allocate memory (and not only in

that case) and that function attempts to acquire a mutex that is already

held. Executing the argument function synchronously from within

dpm_async_fn() may also be problematic for ordering reasons (it may

cause a consumer device's resume callback to be invoked before a

requisite supplier device's one, for example).

Address this by changing the code in question to use

async_schedule_dev_nocall() for scheduling the asynchronous

execution of device suspend and resume functions and to directly

run them synchronously if async_schedule_dev_nocall() returns false.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References