CVE-2024-58057

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

idpf: convert workqueues to unbound

When a workqueue is created with `WQ_UNBOUND`, its work items are

served by special worker-pools, whose host workers are not bound to

any specific CPU. In the default configuration (i.e. when

`queue_delayed_work` and friends do not specify which CPU to run the

work item on), `WQ_UNBOUND` allows the work item to be executed on any

CPU in the same node of the CPU it was enqueued on. While this

solution potentially sacrifices locality, it avoids contention with

other processes that might dominate the CPU time of the processor the

work item was scheduled on.

This is not just a theoretical problem: in a particular scenario

misconfigured process was hogging most of the time from CPU0, leaving

less than 0.5% of its CPU time to the kworker. The IDPF workqueues

that were using the kworker on CPU0 suffered large completion delays

as a result, causing performance degradation, timeouts and ev

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References