Linux: Improper Locking
CVE-2024-26933 is a high-severity improper locking vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 9dac54f08198147f5ec0ec52fcf1bc8ac899ac05, f51849833705dea5b4f9b0c8de714dd87bd6c95c, 4facc9421117ba9d8148c73771b213887fec77f7 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.18% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 9dac54f08198147f5ec0ec52fcf1bc8ac899ac05 or f51849833705dea5b4f9b0c8de714dd87bd6c95c or 4facc9421117ba9d8148c73771b213887fec77f7 or 73d1589b91f2099e5f6534a8497b7c6b527e064e, whichever matches your release line, or a later version.
- Update Linux Kernel to 6.1.84 or 6.6.24 or 6.7.12 or 6.8.3, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | f061f43d7418cb62b8d073e221ec75d3f5b89e17 up to, but not including, 9dac54f08198147f5ec0ec52fcf1bc8ac899ac05; f061f43d7418cb62b8d073e221ec75d3f5b89e17 up to, but not including, f51849833705dea5b4f9b0c8de714dd87bd6c95c; f061f43d7418cb62b8d073e221ec75d3f5b89e17 up to, but not including, 4facc9421117ba9d8148c73771b213887fec77f7; f061f43d7418cb62b8d073e221ec75d3f5b89e17 up to, but not including, 73d1589b91f2099e5f6534a8497b7c6b527e064e; f061f43d7418cb62b8d073e221ec75d3f5b89e17 up to, but not including, f4d1960764d8a70318b02f15203a1be2b2554ca1; 6.0 | 9dac54f08198147f5ec0ec52fcf1bc8ac899ac05, f51849833705dea5b4f9b0c8de714dd87bd6c95c, 4facc9421117ba9d8148c73771b213887fec77f7, 73d1589b91f2099e5f6534a8497b7c6b527e064e, f4d1960764d8a70318b02f15203a1be2b2554ca1 |
| Linux | Linux Kernel | 6.0 up to, but not including, 6.1.84; 6.2 up to, but not including, 6.6.24; 6.7 up to, but not including, 6.7.12; 6.8 up to, but not including, 6.8.3; 6.9 | 6.1.84, 6.6.24, 6.7.12, 6.8.3 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
Official description
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in port "disable" sysfs attribute The show and store callback routines for the "disable" sysfs attribute file in port.c acquire the device lock for the port's parent hub device. This can cause problems if another process has locked the hub to remove it or change its configuration: Removing the hub or changing its configuration requires the hub interface to be removed, which requires the port device to be removed, and device_del() waits until all outstanding sysfs attribute callbacks for the ports have returned. The lock can't be released until then. But the disable_show() or disable_store() routine can't return until after it has acquired the lock. The resulting deadlock can be avoided by calling sysfs_break_active_protection(). This will cause the sysfs core not to wait for the attribute's callback routine to return, allowing the removal to proceed. The disadvantage is that after making this call, there is no guarantee that the hub structure won't be deallocated at any moment. To prevent this, we have to acquire a reference to it first by calling hub_get().
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
How developers prevent this class of flaw
- Use industry standard APIs to implement locking mechanism.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/4facc9421117ba9d8148c73771b213887fec77f7
- git.kernel.org/stable/c/73d1589b91f2099e5f6534a8497b7c6b527e064e
- git.kernel.org/stable/c/9dac54f08198147f5ec0ec52fcf1bc8ac899ac05
- git.kernel.org/stable/c/f4d1960764d8a70318b02f15203a1be2b2554ca1
- git.kernel.org/stable/c/f51849833705dea5b4f9b0c8de714dd87bd6c95c
Recent Improper Locking vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.5 High severity
Spotted an error? Tell us.