CVE-2024-50098

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down

There is a history of deadlock if reboot is performed at the beginning

of booting. SDEV_QUIESCE was set for all LU's scsi_devices by UFS

shutdown, and at that time the audio driver was waiting on

blk_mq_submit_bio() holding a mutex_lock while reading the fw binary.

After that, a deadlock issue occurred while audio driver shutdown was

waiting for mutex_unlock of blk_mq_submit_bio(). To solve this, set

SDEV_OFFLINE for all LUs except WLUN, so that any I/O that comes down

after a UFS shutdown will return an error.

[ 31.907781]I[0: swapper/0: 0] 1 130705007 1651079834 11289729804 0 D( 2) 3 ffffff882e208000 * init [device_shutdown]

[ 31.907793]I[0: swapper/0: 0] Mutex: 0xffffff8849a2b8b0: owner[0xffffff882e28cb00 kworker/6:0 :49]

[ 31.907806]I[0: swapper/0: 0] Call trace:

[ 31.9078

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References