Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-57946— virtio-blk: don't keep queue frozen during system suspend

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于virtio-blk模块在系统挂起时冻结了队列，这可能导致死锁或系统挂起。

AI Predicted 4.3 Difficulty: Moderate EPSS 0.17% · P6

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 25

VendorProduct Version RangeStatus
Linux Linux b7bfaea8f5ecd290864f5ae4c69859b89832b4dc< d738f3215bb4f88911ff4579780a44960c8e0ca5 affected
5fe446b245ba61ddc924d7db280bcd987c39357a< 9ca428c6397abaa8c38f5c69133a2299e1efbbf2 affected
2a52590ac52394540351d8289cc2af0b83cf7d31< 6dea8e3de59928974bf157dd0499d3958d744ae4 affected
db48acce75d73dfe51c43d56893cce067b73cf08< 9e323f856cf4963120e0e3892a84ef8bd764a0e4 affected
8946924ff324853df6b7c525a7467d964dfd11c3< 12c0ddd6c551c1e438b087f874b4f1223a75f7ea affected
4ce6e2db00de8103a0687fb0f65fd17124a51aaa< 92d5139b91147ab372a17daf5dc27a5b9278e516 affected
4ce6e2db00de8103a0687fb0f65fd17124a51aaa< 7678abee0867e6b7fb89aa40f6e9f575f755fb37 affected
2b5128c714d863cd8d259aa9d87bed2d6aa6a5a8 affected
… +17 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-57946

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
virtio-blk: don't keep queue frozen during system suspend
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: virtio-blk: don't keep queue frozen during system suspend Commit 4ce6e2db00de ("virtio-blk: Ensure no requests in virtqueues before deleting vqs.") replaces queue quiesce with queue freeze in virtio-blk's PM callbacks. And the motivation is to drain inflight IOs before suspending. block layer's queue freeze looks very handy, but it is also easy to cause deadlock, such as, any attempt to call into bio_queue_enter() may run into deadlock if the queue is frozen in current context. There are all kinds of ->suspend() called in suspend context, so keeping queue frozen in the whole suspend context isn't one good idea. And Marek reported lockdep warning[1] caused by virtio-blk's freeze queue in virtblk_freeze(). [1] https://lore.kernel.org/linux-block/ca16370e-d646-4eee-b9cc-87277c89c43c@samsung.com/ Given the motivation is to drain in-flight IOs, it can be done by calling freeze & unfreeze, meantime restore to previous behavior by keeping queue quiesced during suspend.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于virtio-blk模块在系统挂起时冻结了队列，这可能导致死锁或系统挂起。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux b7bfaea8f5ecd290864f5ae4c69859b89832b4dc ~ d738f3215bb4f88911ff4579780a44960c8e0ca5 -
Linux Linux 6.8 -

II. Public POCs for CVE-2024-57946

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-57946

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-57946 (7)

Same Patch Batch · Linux · 2025-01-21 · 25 CVEs total

CVE-2025-21663 10.0 CRITICAL net: stmmac: dwmac-tegra: Read iommu stream id from device tree
CVE-2024-57932 9.8 CRITICAL gve: guard XDP xmit NDO on existence of xdp queues
CVE-2024-57936 9.8 CRITICAL RDMA/bnxt_re: Fix max SGEs for the Work Request
CVE-2025-21659 8.1 HIGH netdev: prevent accessing NAPI instances from another namespace
CVE-2025-21664 7.8 HIGH dm thin: make get_first_thin use rcu-safe list first function
CVE-2025-21661 7.8 HIGH gpio: virtuser: fix missing lookup table cleanups
CVE-2024-57945 7.8 HIGH riscv: mm: Fix the out of bound issue of vmemmap address
CVE-2024-57943 exfat: fix the new buffer was not zeroed before writing
CVE-2025-21662 net/mlx5: Fix variable not being completed when function returns
CVE-2025-21660 ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
CVE-2025-21658 btrfs: avoid NULL pointer dereference if no valid extent tree
CVE-2025-21657 sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass()
CVE-2025-21656 hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur
CVE-2024-57944 iio: adc: ti-ads1298: Add NULL check in ads1298_init
CVE-2024-57930 tracing: Have process_string() also allow arrays
CVE-2024-57942 netfs: Fix ceph copy to cache on write-begin
CVE-2024-57941 netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled
CVE-2024-57940 exfat: fix the infinite loop in exfat_readdir()
CVE-2024-57939 riscv: Fix sleeping in invalid context in die()
CVE-2024-57938 net/sctp: Prevent autoclose integer overflow in sctp_association_init()

Showing top 20 of 25 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-57946

No comments yet

Leave a comment