PT-2024-35520 · Linux+1 · Linux Kernel+1

Published 2024-11-19 · Updated 2026-01-13 · CVE-2024-53054

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A deadlock issue in the Linux kernel has been identified, which can be triggered by deleting a large number of cpuset cgroups and setting cpu on and off repeatedly. This issue is caused by the acquisition of cgroup mutex and cpu hotplug lock in different tasks, leading to a deadlock. The problem can be reproduced using a pressuse test, which involves deleting a large number of cpuset cgroups, setting cpu on and off repeatedly, and setting watchdog thresh repeatedly. The estimated number of potentially affected devices worldwide is not available.

Recommendations To fix the problem, place cgroup bpf release works on a dedicated workqueue, which can break the loop and solve the problem. As a temporary workaround, consider disabling the cgroup bpf release function until a patch is available. Restrict access to the cgroup mutex and cpu hotplug lock to minimize the risk of exploitation. Avoid using the cpu hotplug lock.read and cpu hotplug lock.write in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

CVE-2024-53054

DSA-5818-1

Affected Products

Linux Kernel

Red Os

References · 16

• https://cve.org/CVERecord?id=CVE-2024-53054 · Security Note
• https://git.kernel.org/stable/c/6dab3331523ba73db1345d19e6f586dcd5f6efb4 · Patch
• https://security-tracker.debian.org/tracker/CVE-2024-53054 · Vendor Advisory
• https://git.kernel.org/stable/c/71f14a9f5c7db72fdbc56e667d4ed42a1a760494 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-53054 · Security Note
• https://ubuntu.com/security/CVE-2024-53054 · Vendor Advisory
• https://git.kernel.org/stable/c/117932eea99b729ee5d12783601a4f7f5fd58a23 · Patch
• https://osv.dev/vulnerability/CVE-2024-53054 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5818-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-53054 · Vendor Advisory
• https://git.kernel.org/stable/c/0d86cd70fc6a7ba18becb52ad8334d5ad3eca530 · Patch
• https://git.kernel.org/linus/117932eea99b729ee5d12783601a4f7f5fd58a23 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-kernel-lt-cve-2024-53054-7.3 · Note
• https://twitter.com/UndercodeNews/status/1860041168412877109 · Twitter Post
• https://twitter.com/matarturo/status/1860051002067681660 · Twitter Post