CVE-2024-27003 clk: Get runtime PM before walking tree for clk_summary
A race condition in the Linux kernel clock subsystem can cause a deadlock when accessing clk_summary via debugfs, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-27003?
CVE-2024-27003 is a medium-severity vulnerability in Linux kernel, published on 1 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
clk: Get runtime PM before walking tree for clk_summary
Similar to the previous commit, we should make sure that all devices are runtime resumed before printing the clk_summary through debugfs. Failure to do so would result in a deadlock if the thread is resuming a device to print clk state and that device is also runtime resuming in another thread, e.g the screen is turning on and the display driver is starting up. We remove the calls to clk_pm_runtime_{get,put}() in this path because they're superfluous now that we know the devices are runtime resumed. This also squashes a bug where the return value of clk_pm_runtime_get() wasn't checked, leading to an RPM count underflow on error paths.
Weakness: CWE-667
Which versions are affected by CVE-2024-27003?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-27003?
Apply the vendor's patch.
Is CVE-2024-27003 being exploited?
There is no known exploitation of CVE-2024-27003 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-27003, DEBIAN-CVE-2024-27003, GHSA-vq68-hhvf-c7xp, UBUNTU-CVE-2024-27003.