CVE-2023-52498 PM: sleep: Fix possible deadlocks in core system-wide PM code
A deadlock in the Linux kernel's system-wide power management code can cause a denial of service during low-memory resume operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52498?
CVE-2023-52498 is a medium-severity vulnerability in Linux kernel, published on 29 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
PM: sleep: Fix possible deadlocks in core system-wide PM code
It is reported that in low-memory situations the system-wide resume core code deadlocks, because async_schedule_dev() executes its argument function synchronously if it cannot allocate memory (and not only in that case) and that function attempts to acquire a mutex that is already held. Executing the argument function synchronously from within dpm_async_fn() may also be problematic for ordering reasons (it may cause a consumer device's resume callback to be invoked before a requisite supplier device's one, for example).
Address this by changing the code in question to use async_schedule_dev_nocall() for scheduling the asynchronous execution of device suspend and resume functions and to directly run them synchronously if async_schedule_dev_nocall() returns false.
Weakness: CWE-667
Which versions are affected by CVE-2023-52498?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-52498?
Apply the vendor's patch.
Is CVE-2023-52498 being exploited?
There is no known exploitation of CVE-2023-52498 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-52498, DEBIAN-CVE-2023-52498, GHSA-wv5g-rv8w-9x7p, UBUNTU-CVE-2023-52498.