Homepage
About Snyk

CVE-2024-26671 Affecting kernel-uki-virt package, versions <0:5.14.0-427.13.1.el9_4

Severity

 Recommended
high

Based on AlmaLinux security rating

    Threat Intelligence

    EPSS
    0.04% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-ALMALINUX9-KERNELUKIVIRT-8340551
  • published 4 Nov 2024
  • disclosed 30 Apr 2024
Report a new vulnerability Found a mistake?

Introduced: 30 Apr 2024

CVE-2024-26671 Open this link in a new tab

How to fix?

Upgrade AlmaLinux:9 kernel-uki-virt to version 0:5.14.0-427.13.1.el9_4 or higher.
This issue was patched in ALSA-2024:2394.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-uki-virt package and not the kernel-uki-virt package as distributed by AlmaLinux. See How to fix? for AlmaLinux:9 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

blk-mq: fix IO hang from sbitmap wakeup race

In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure.

Then in __sbitmap_queue_wake_up(), waitqueue_active() may not observe the added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime blk_mq_mark_tag_wait() can't get driver tag successfully.

This issue can be reproduced by running the following test in loop, and fio hang can be observed in < 30min when running it on my test VM in laptop.

modprobe -r scsi_debug
modprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4
dev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename`
fio --filename=/dev/&#34;$dev&#34; --direct=1 --rw=randrw --bs=4k --iodepth=1 \
           --runtime=100 --numjobs=40 --time_based --name=test \
        --ioengine=libaio

Fix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which is just fine in case of running out of tag.

References

CVSS Scores

version 3.1
Expand this section

Red Hat

4.4 medium
  • Attack Vector (AV)
    Local
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    High
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    None
  • Integrity (I)
    None
  • Availability (A)
    High
Expand this section

SUSE

5.5 medium