CVE-2024-47744

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: Use dedicated mutex to protect kvm_usage_count to avoid deadlock

Use a dedicated mutex to guard kvm_usage_count to fix a potential deadlock

on x86 due to a chain of locks and SRCU synchronizations. Translating the

below lockdep splat, CPU1 #6 will wait on CPU0 #1, CPU0 #8 will wait on

CPU2 #3, and CPU2 #7 will wait on CPU1 #4 (if there's a writer, due to the

fairness of r/w semaphores).

CPU0 CPU1 CPU2

1 lock(&kvm->slots_lock);

2 lock(&vcpu->mutex);

3 lock(&kvm->srcu);

4 lock(cpu_hotplug_lock);

5 lock(kvm_lock);

6 lock(&kvm->slots_lock);

7 lock(cpu_hotplug_lock);

8 sync(&kvm->srcu);

Note, there are likely more potential deadlocks

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References