linux-cve-announce - CVE-2024-57807: scsi: megaraid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025011153-CVE-2024-57807-b595@gregkh>
Date: Sat, 11 Jan 2025 13:39:59 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-57807: scsi: megaraid_sas: Fix for a potential deadlock

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

scsi: megaraid_sas: Fix for a potential deadlock

This fixes a 'possible circular locking dependency detected' warning
      CPU0                    CPU1
      ----                    ----
 lock(&instance->reset_mutex);
                              lock(&shost->scan_mutex);
                              lock(&instance->reset_mutex);
 lock(&shost->scan_mutex);

Fix this by temporarily releasing the reset_mutex.

The Linux kernel CVE team has assigned CVE-2024-57807 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.4.289 with commit 78afb9bfad00c4aa58a424111d7edbcab9452f2b
	Fixed in 5.10.233 with commit f36d024bd15ed356a80dda3ddc46d0a62aa55815
	Fixed in 5.15.176 with commit 3c654998a3e8167a58b6c6fede545fe400a4b554
	Fixed in 6.1.123 with commit edadc693bfcc0f1ea08b8fa041c9361fd042410d
	Fixed in 6.6.69 with commit f50783148ec98a1d38b87422e2ceaf2380b7b606
	Fixed in 6.12.8 with commit 466ca39dbf5d0ba71c16b15c27478a9c7d4022a8
	Fixed in 6.13-rc2 with commit 50740f4dc78b41dec7c8e39772619d5ba841ddd7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-57807
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/scsi/megaraid/megaraid_sas_base.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/78afb9bfad00c4aa58a424111d7edbcab9452f2b
	https://git.kernel.org/stable/c/f36d024bd15ed356a80dda3ddc46d0a62aa55815
	https://git.kernel.org/stable/c/3c654998a3e8167a58b6c6fede545fe400a4b554
	https://git.kernel.org/stable/c/edadc693bfcc0f1ea08b8fa041c9361fd042410d
	https://git.kernel.org/stable/c/f50783148ec98a1d38b87422e2ceaf2380b7b606
	https://git.kernel.org/stable/c/466ca39dbf5d0ba71c16b15c27478a9c7d4022a8
	https://git.kernel.org/stable/c/50740f4dc78b41dec7c8e39772619d5ba841ddd7