Deadlock Affecting kernel-bootwrapper package, versions *
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-CENTOS7-KERNELBOOTWRAPPER-7143591
- published 27 May 2024
- disclosed 22 May 2024
Introduced: 22 May 2024
CVE-2021-47469 Open this link in a new tabHow to fix?
There is no fixed version for Centos:7 kernel-bootwrapper.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-bootwrapper package and not the kernel-bootwrapper package as distributed by Centos.
See How to fix? for Centos:7 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
spi: Fix deadlock when adding SPI controllers on SPI buses
Currently we have a global spi_add_lock which we take when adding new devices so that we can check that we're not trying to reuse a chip select that's already controlled. This means that if the SPI device is itself a SPI controller and triggers the instantiation of further SPI devices we trigger a deadlock as we try to register and instantiate those devices while in the process of doing so for the parent controller and hence already holding the global spi_add_lock. Since we only care about concurrency within a single SPI bus move the lock to be per controller, avoiding the deadlock.
This can be easily triggered in the case of spi-mux.
References
- https://access.redhat.com/security/cve/CVE-2021-47469
- https://git.kernel.org/stable/c/6098475d4cb48d821bdf453c61118c56e26294f0
- https://git.kernel.org/stable/c/722ef19a161ce3fffb3d1b01ce2301c306639bdd
- https://git.kernel.org/stable/c/aa3f3d7bef59583f2d3234173105a27ff61ef8fe
- https://git.kernel.org/stable/c/c8dce228db6f81dbc897a018dfc5c418e917cf64