CVE-2024-27005

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

interconnect: Don't access req_list while it's being manipulated

The icc_lock mutex was split into separate icc_lock and icc_bw_lock

mutexes in [1] to avoid lockdep splats. However, this didn't adequately

protect access to icc_node::req_list.

The icc_set_bw() function will eventually iterate over req_list while

only holding icc_bw_lock, but req_list can be modified while only

holding icc_lock. This causes races between icc_set_bw(), of_icc_get(),

and icc_put().

Example A:

CPU0 CPU1

---- ----

icc_set_bw(path_a)

mutex_lock(&icc_bw_lock);

icc_put(path_b)

mutex_lock(&icc_lock);

aggregate_requests()

hlist_for_each_entry(r, ...

hlist_del(...

<r = invalid pointer>

Example B:

CPU0 CPU1

-

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References