CVE-2024-45029 i2c: tegra: Do not mark ACPI devices as irq safe
A locking bug in the Tegra I2C driver causes a kernel panic on ACPI systems, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45029?
CVE-2024-45029 is a medium-severity vulnerability in Linux kernel, published on 11 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
i2c: tegra: Do not mark ACPI devices as irq safe
On ACPI machines, the tegra i2c module encounters an issue due to a mutex being called inside a spinlock. This leads to the following bug:
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585 ...
Call trace: __might_sleep __mutex_lock_common mutex_lock_nested acpi_subsys_runtime_resume rpm_resume tegra_i2c_xfer
The problem arises because during __pm_runtime_resume(), the spinlock &dev->power.lock is acquired before rpm_resume() is called. Later, rpm_resume() invokes acpi_subsys_runtime_resume(), which relies on mutexes, triggering the error.
To address this issue, devices on ACPI are now marked as not IRQ-safe, considering the dependency of acpi_subsys_runtime_resume() on mutexes.
Weakness: CWE-667
Which versions are affected by CVE-2024-45029?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-45029?
Apply the vendor's patch.
Is CVE-2024-45029 being exploited?
There is no known exploitation of CVE-2024-45029 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-49212, BELL-CVE-2024-45029, DEBIAN-CVE-2024-45029, GHSA-ww57-48hq-5w83, UBUNTU-CVE-2024-45029.