Improper Locking Affecting kernel-uek-core package, versions <0:5.15.0-302.167.6.el8uek


Severity

Recommended
high

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.04% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE8-KERNELUEKCORE-8372976
  • published14 Nov 2024
  • disclosed4 Sept 2024

Introduced: 4 Sep 2024

CVE-2024-44995  (opens in a new tab)
CWE-667  (opens in a new tab)

How to fix?

Upgrade Oracle:8 kernel-uek-core to version 0:5.15.0-302.167.6.el8uek or higher.
This issue was patched in ELSA-2024-12815.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-uek-core package and not the kernel-uek-core package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

net: hns3: fix a deadlock problem when config TC during resetting

When config TC during the reset process, may cause a deadlock, the flow is as below: pf reset start │ ▼ ...... setup tc │ │ ▼ ▼ DOWN: napi_disable() napi_disable()(skip) │ │ │ ▼ ▼ ...... ...... │ │ ▼ │ napi_enable() │ ▼ UINIT: netif_napi_del() │ ▼ ...... │ ▼ INIT: netif_napi_add() │ ▼ ...... global reset start │ │ ▼ ▼ UP: napi_enable()(skip) ...... │ │ ▼ ▼ ...... napi_disable()

In reset process, the driver will DOWN the port and then UINIT, in this case, the setup tc process will UP the port before UINIT, so cause the problem. Adds a DOWN process in UINIT to fix it.

CVSS Scores

version 3.1