CVE-2024-35809

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

PCI/PM: Drain runtime-idle callbacks before driver removal

A race condition between the .runtime_idle() callback and the .remove()

callback in the rtsx_pcr PCI driver leads to a kernel crash due to an

unhandled page fault [1].

The problem is that rtsx_pci_runtime_idle() is not expected to be running

after pm_runtime_get_sync() has been called, but the latter doesn't really

guarantee that. It only guarantees that the suspend and resume callbacks

will not be running when it returns.

However, if a .runtime_idle() callback is already running when

pm_runtime_get_sync() is called, the latter will notice that the runtime PM

status of the device is RPM_ACTIVE and it will return right away without

waiting for the former to complete. In fact, it cannot wait for

.runtime_idle() to complete because it may be called from that callback (it

arguably does not make much sense to do that, but it is not strictly

prohibited).

Thus

Remediation

Check the references section for vendor advisories and patches from debian. Update debian_linux to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References