CVE-2024-38613

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

m68k: Fix spinlock race in kernel thread creation

Context switching does take care to retain the correct lock owner across

the switch from 'prev' to 'next' tasks. This does rely on interrupts

remaining disabled for the entire duration of the switch.

This condition is guaranteed for normal process creation and context

switching between already running processes, because both 'prev' and

'next' already have interrupts disabled in their saved copies of the

status register.

The situation is different for newly created kernel threads. The status

register is set to PS_S in copy_thread(), which does leave the IPL at 0.

Upon restoring the 'next' thread's status register in switch_to() aka

resume(), interrupts then become enabled prematurely. resume() then

returns via ret_from_kernel_thread() and schedule_tail() where run queue

lock is released (see finish_task_switch() and finish_lock_switch()).

A timer interrupt callin

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References