Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-41036— net: ks8851: Fix deadlock with the SPI chip variant

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于在SMP启用的情况下，statelock自旋锁在ks8851_start_xmit_spi和ks8851_irq之间存在死锁问题。

CVSS 7.5 · High EPSS 0.75% · P54

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux 1092525155eaad5c69ca9f3b6f3e7895a9424d66< a0c69c492f4a8fad52f0a97565241c926160c9a4 affected
30302b41ffdcd194bef27fb3b1a9f2ca53dedb27< 80ece00137300d74642f2038c8fe5440deaf9f05 affected
3dc5d44545453de1de9c53cc529cc960a85933da< 10fec0cd0e8f56ff06c46bb24254c7d8f8f2bbf0 affected
3dc5d44545453de1de9c53cc529cc960a85933da< 0913ec336a6c0c4a2b296bd9f74f8e41c4c83c8c affected
786788bb1396ed5ea27e39c4933f59f4e52004e4 affected
7c25c5d7274631b655f0f9098a16241fcd5db57b affected
6.1.70< 6.1.100 affected
6.6.9< 6.6.41 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-41036

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: ks8851: Fix deadlock with the SPI chip variant
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: ks8851: Fix deadlock with the SPI chip variant When SMP is enabled and spinlocks are actually functional then there is a deadlock with the 'statelock' spinlock between ks8851_start_xmit_spi and ks8851_irq: watchdog: BUG: soft lockup - CPU#0 stuck for 27s! call trace: queued_spin_lock_slowpath+0x100/0x284 do_raw_spin_lock+0x34/0x44 ks8851_start_xmit_spi+0x30/0xb8 ks8851_start_xmit+0x14/0x20 netdev_start_xmit+0x40/0x6c dev_hard_start_xmit+0x6c/0xbc sch_direct_xmit+0xa4/0x22c __qdisc_run+0x138/0x3fc qdisc_run+0x24/0x3c net_tx_action+0xf8/0x130 handle_softirqs+0x1ac/0x1f0 __do_softirq+0x14/0x20 ____do_softirq+0x10/0x1c call_on_irq_stack+0x3c/0x58 do_softirq_own_stack+0x1c/0x28 __irq_exit_rcu+0x54/0x9c irq_exit_rcu+0x10/0x1c el1_interrupt+0x38/0x50 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x64/0x68 __netif_schedule+0x6c/0x80 netif_tx_wake_queue+0x38/0x48 ks8851_irq+0xb8/0x2c8 irq_thread_fn+0x2c/0x74 irq_thread+0x10c/0x1b0 kthread+0xc8/0xd8 ret_from_fork+0x10/0x20 This issue has not been identified earlier because tests were done on a device with SMP disabled and so spinlocks were actually NOPs. Now use spin_(un)lock_bh for TX queue related locking to avoid execution of softirq work synchronously that would lead to a deadlock.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于在SMP启用的情况下，statelock自旋锁在ks8851_start_xmit_spi和ks8851_irq之间存在死锁问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1092525155eaad5c69ca9f3b6f3e7895a9424d66 ~ a0c69c492f4a8fad52f0a97565241c926160c9a4 -
Linux Linux 6.7 -

II. Public POCs for CVE-2024-41036

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-41036

请登录查看更多情报信息。

Other References for CVE-2024-41036 (4)

Same Patch Batch · Linux · 2024-07-29 · 121 CVEs total

CVE-2024-41040 9.8 CRITICAL net/sched: Fix UAF when resolving a clash
CVE-2024-41081 9.8 CRITICAL ila: block BH in ila_output()
CVE-2024-41073 9.8 CRITICAL nvme: avoid double free special payload
CVE-2024-41091 8.8 HIGH tun: add missing verification for short frame
CVE-2024-41090 8.8 HIGH tap: add missing verification for short frame
CVE-2024-41046 8.8 HIGH net: ethernet: lantiq_etop: fix double free in detach
CVE-2024-42083 8.8 HIGH ionic: fix kernel panic due to multi-buffer handling
CVE-2024-41062 8.8 HIGH bluetooth/l2cap: sync sock recv cb and release
CVE-2024-41045 7.8 HIGH bpf: Defer work in bpf_timer_cancel_and_free
CVE-2024-41051 7.8 HIGH cachefiles: wait for ondemand_object_worker to finish when dropping object
CVE-2024-41049 7.8 HIGH filelock: fix potential use-after-free in posix_lock_inode
CVE-2024-41057 7.8 HIGH cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()
CVE-2024-41060 7.8 HIGH drm/radeon: check bo_va->bo is non-NULL before using it
CVE-2024-41059 7.8 HIGH hfsplus: fix uninit-value in copy_name
CVE-2024-42075 7.8 HIGH bpf: Fix remap of arena.
CVE-2024-41064 7.8 HIGH powerpc/eeh: avoid possible crash when edev->pdev changes
CVE-2024-42072 7.8 HIGH bpf: Fix may_goto with negative offset.
CVE-2024-42064 7.8 HIGH drm/amd/display: Skip pipe if the pipe idx not set properly
CVE-2024-41086 7.8 HIGH bcachefs: Fix sb_field_downgrade validation
CVE-2024-41087 7.8 HIGH ata: libata-core: Fix double free on error

Showing top 20 of 121 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-41036

No comments yet

Leave a comment