PT-2024-7624 · Linux+5 · Linux Kernel+5

Ming Lei · Published 2024-01-23 · Updated 2024-11-05 · CVE-2024-26627

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the scsi host busy() function in the Linux kernel, which can cause a hard lockup when acquiring a host lock during recovery. This occurs when there are a large number of hardware queues and a high queue depth, leading to a significant number of iterations over tag/requests. The problem is resolved by calling scsi host busy() outside the host lock, as the host lock is not necessary for getting the busy count.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2024-09030

CVE-2024-26627

DLA-3842-1

DSA-5658-1

DSA-5681-1

OESA-2024-1353

OESA-2024-1355

OESA-2024-1356

OESA-2024-1357

OPENSUSE-SU-2024_1322-1

OPENSUSE-SU-2024_1322-2

OPENSUSE-SU-2024_1332-1

OPENSUSE-SU-2024_1332-2

OPENSUSE-SU-2024_1466-1

OPENSUSE-SU-2024_1480-1

OPENSUSE-SU-2024_1490-1

SUSE-SU-2024:1466-1

SUSE-SU-2024:1480-1

SUSE-SU-2024:1490-1

USN-6688-1

USN-6765-1

USN-6766-1

USN-6766-2

USN-6766-3

USN-6795-1

USN-6818-1

USN-6818-2

USN-6818-3

USN-6818-4

USN-6819-1

USN-6819-2

USN-6819-3

USN-6819-4

USN-6828-1

Affected Products

Astra Linux

Linuxmint

Linux Kernel

Red Os

Suse

Ubuntu

References · 892

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26627.json · Exploit
• 🔥 https://github.com/Notselwyn/CVE-2024-1086 · Exploit
• 🔥 https://github.com/LLfam/CVE-2024-1086 · Exploit
• 🔥 https://github.com/MaherAzzouzi/CVE-2024-26817-amdkfd · Exploit
• https://git.kernel.org/stable/c/f5944853f7a961fedc1227dc8f60393f8936d37c · Patch
• https://ubuntu.com/security/CVE-2023-52642 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26698 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-26627 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-52644 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6766-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26601 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26751 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-35811 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-27044 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26602 · Vendor Advisory