CVE-2024-56625 can: dev: can_set_termination(): allow sleeping GPIOs
A kernel warning triggered by sleeping GPIOs in the CAN termination driver can cause system instability or crashes on embedded devices using I2C port expanders.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-56625?
CVE-2024-56625 is a medium-severity denial of service vulnerability in Linux kernel, published on 27 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
can: dev: can_set_termination(): allow sleeping GPIOs
In commit 6e86a1543c37 ("can: dev: provide optional GPIO based termination support") GPIO based termination support was added.
For no particular reason that patch uses gpiod_set_value() to set the GPIO. This leads to the following warning, if the systems uses a sleeping GPIO, i.e. behind an I2C port expander:
| WARNING: CPU: 0 PID: 379 at /drivers/gpio/gpiolib.c:3496 gpiod_set_value+0x50/0x6c | CPU: 0 UID: 0 PID: 379 Comm: ip Not tainted 6.11.0-20241016-1 #1 823affae360cc91126e4d316d7a614a8bf86236c
Replace gpiod_set_value() by gpiod_set_value_cansleep() to allow the use of sleeping GPIOs.
Which versions are affected by CVE-2024-56625?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-56625?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-56625 being exploited?
There is no known exploitation of CVE-2024-56625 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-56625, DEBIAN-CVE-2024-56625, GHSA-h6p5-h73r-mpjh, UBUNTU-CVE-2024-56625.