SB20240603109 - Improper locking in Linux kernel pci driver

Description

This security bulletin contains information about 1 security vulnerability.

1) Improper locking (CVE-ID: CVE-2024-26605)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the pcie_aspm_exit_link_state() and pcie_aspm_pm_state_change() functions in drivers/pci/pcie/aspm.c, within the pci_power_up(), pci_set_full_power_state(), pci_bus_set_current_state(), pci_set_low_power_state() and pci_set_power_state() functions in drivers/pci/pci.c, within the qcom_pcie_enable_aspm() function in drivers/pci/controller/dwc/pcie-qcom.c, within the pci_bus_add_devices() and pci_walk_bus() functions in drivers/pci/bus.c. A local user can perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/ef90508574d7af48420bdc5f7b9a4f1cdd26bc70
• https://git.kernel.org/stable/c/1e560864159d002b453da42bd2c13a1805515a20
• https://git.kernel.org/stable/c/0f7908a016c092cfdaa16d785fa5099d867bc1a3
• https://git.kernel.org/stable/c/b0f4478838be1f1d330061201898fef65bf8fd7c
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.29