CVE-2024-46797 (GCVE-0-2024-46797)

Vulnerability from cvelistv5 – Published: 2024-09-18 07:12 – Updated: 2026-05-11 20:36
VLAI
Title
powerpc/qspinlock: Fix deadlock in MCS queue
Summary
In the Linux kernel, the following vulnerability has been resolved: powerpc/qspinlock: Fix deadlock in MCS queue If an interrupt occurs in queued_spin_lock_slowpath() after we increment qnodesp->count and before node->lock is initialized, another CPU might see stale lock values in get_tail_qnode(). If the stale lock value happens to match the lock on that CPU, then we write to the "next" pointer of the wrong qnode. This causes a deadlock as the former CPU, once it becomes the head of the MCS queue, will spin indefinitely until it's "next" pointer is set by its successor in the queue. Running stress-ng on a 16 core (16EC/16VP) shared LPAR, results in occasional lockups similar to the following: $ stress-ng --all 128 --vm-bytes 80% --aggressive \ --maximize --oomable --verify --syslog \ --metrics --times --timeout 5m watchdog: CPU 15 Hard LOCKUP ...... NIP [c0000000000b78f4] queued_spin_lock_slowpath+0x1184/0x1490 LR [c000000001037c5c] _raw_spin_lock+0x6c/0x90 Call Trace: 0xc000002cfffa3bf0 (unreliable) _raw_spin_lock+0x6c/0x90 raw_spin_rq_lock_nested.part.135+0x4c/0xd0 sched_ttwu_pending+0x60/0x1f0 __flush_smp_call_function_queue+0x1dc/0x670 smp_ipi_demux_relaxed+0xa4/0x100 xive_muxed_ipi_action+0x20/0x40 __handle_irq_event_percpu+0x80/0x240 handle_irq_event_percpu+0x2c/0x80 handle_percpu_irq+0x84/0xd0 generic_handle_irq+0x54/0x80 __do_irq+0xac/0x210 __do_IRQ+0x74/0xd0 0x0 do_IRQ+0x8c/0x170 hardware_interrupt_common_virt+0x29c/0x2a0 --- interrupt: 500 at queued_spin_lock_slowpath+0x4b8/0x1490 ...... NIP [c0000000000b6c28] queued_spin_lock_slowpath+0x4b8/0x1490 LR [c000000001037c5c] _raw_spin_lock+0x6c/0x90 --- interrupt: 500 0xc0000029c1a41d00 (unreliable) _raw_spin_lock+0x6c/0x90 futex_wake+0x100/0x260 do_futex+0x21c/0x2a0 sys_futex+0x98/0x270 system_call_exception+0x14c/0x2f0 system_call_vectored_common+0x15c/0x2ec The following code flow illustrates how the deadlock occurs. For the sake of brevity, assume that both locks (A and B) are contended and we call the queued_spin_lock_slowpath() function. CPU0 CPU1 ---- ---- spin_lock_irqsave(A) | spin_unlock_irqrestore(A) | spin_lock(B) | | | ▼ | id = qnodesp->count++; | (Note that nodes[0].lock == A) | | | ▼ | Interrupt | (happens before "nodes[0].lock = B") | | | ▼ | spin_lock_irqsave(A) | | | ▼ | id = qnodesp->count++ | nodes[1].lock = A | | | ▼ | Tail of MCS queue | | spin_lock_irqsave(A) ▼ | Head of MCS queue ▼ | CPU0 is previous tail ▼ | Spin indefinitely ▼ (until "nodes[1].next != NULL") prev = get_tail_qnode(A, CPU0) | ▼ prev == &qnodes[CPU0].nodes[0] (as qnodes ---truncated---
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 84990b169557428c318df87b7836cd15f65b62dc , < d84ab6661e8d09092de9b034b016515ef9b66085 (git)
Affected: 84990b169557428c318df87b7836cd15f65b62dc , < f06af737e4be28c0e926dc25d5f0a111da4e2987 (git)
Affected: 84990b169557428c318df87b7836cd15f65b62dc , < 734ad0af3609464f8f93e00b6c0de1e112f44559 (git)
Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.51 , ≤ 6.6.* (semver)
Unaffected: 6.10.10 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46797",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T14:22:25.653688Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T14:22:38.796Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/lib/qspinlock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d84ab6661e8d09092de9b034b016515ef9b66085",
              "status": "affected",
              "version": "84990b169557428c318df87b7836cd15f65b62dc",
              "versionType": "git"
            },
            {
              "lessThan": "f06af737e4be28c0e926dc25d5f0a111da4e2987",
              "status": "affected",
              "version": "84990b169557428c318df87b7836cd15f65b62dc",
              "versionType": "git"
            },
            {
              "lessThan": "734ad0af3609464f8f93e00b6c0de1e112f44559",
              "status": "affected",
              "version": "84990b169557428c318df87b7836cd15f65b62dc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/lib/qspinlock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.51",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.10",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/qspinlock: Fix deadlock in MCS queue\n\nIf an interrupt occurs in queued_spin_lock_slowpath() after we increment\nqnodesp-\u003ecount and before node-\u003elock is initialized, another CPU might\nsee stale lock values in get_tail_qnode(). If the stale lock value happens\nto match the lock on that CPU, then we write to the \"next\" pointer of\nthe wrong qnode. This causes a deadlock as the former CPU, once it becomes\nthe head of the MCS queue, will spin indefinitely until it\u0027s \"next\" pointer\nis set by its successor in the queue.\n\nRunning stress-ng on a 16 core (16EC/16VP) shared LPAR, results in\noccasional lockups similar to the following:\n\n   $ stress-ng --all 128 --vm-bytes 80% --aggressive \\\n               --maximize --oomable --verify  --syslog \\\n               --metrics  --times  --timeout 5m\n\n   watchdog: CPU 15 Hard LOCKUP\n   ......\n   NIP [c0000000000b78f4] queued_spin_lock_slowpath+0x1184/0x1490\n   LR [c000000001037c5c] _raw_spin_lock+0x6c/0x90\n   Call Trace:\n    0xc000002cfffa3bf0 (unreliable)\n    _raw_spin_lock+0x6c/0x90\n    raw_spin_rq_lock_nested.part.135+0x4c/0xd0\n    sched_ttwu_pending+0x60/0x1f0\n    __flush_smp_call_function_queue+0x1dc/0x670\n    smp_ipi_demux_relaxed+0xa4/0x100\n    xive_muxed_ipi_action+0x20/0x40\n    __handle_irq_event_percpu+0x80/0x240\n    handle_irq_event_percpu+0x2c/0x80\n    handle_percpu_irq+0x84/0xd0\n    generic_handle_irq+0x54/0x80\n    __do_irq+0xac/0x210\n    __do_IRQ+0x74/0xd0\n    0x0\n    do_IRQ+0x8c/0x170\n    hardware_interrupt_common_virt+0x29c/0x2a0\n   --- interrupt: 500 at queued_spin_lock_slowpath+0x4b8/0x1490\n   ......\n   NIP [c0000000000b6c28] queued_spin_lock_slowpath+0x4b8/0x1490\n   LR [c000000001037c5c] _raw_spin_lock+0x6c/0x90\n   --- interrupt: 500\n    0xc0000029c1a41d00 (unreliable)\n    _raw_spin_lock+0x6c/0x90\n    futex_wake+0x100/0x260\n    do_futex+0x21c/0x2a0\n    sys_futex+0x98/0x270\n    system_call_exception+0x14c/0x2f0\n    system_call_vectored_common+0x15c/0x2ec\n\nThe following code flow illustrates how the deadlock occurs.\nFor the sake of brevity, assume that both locks (A and B) are\ncontended and we call the queued_spin_lock_slowpath() function.\n\n        CPU0                                   CPU1\n        ----                                   ----\n  spin_lock_irqsave(A)                          |\n  spin_unlock_irqrestore(A)                     |\n    spin_lock(B)                                |\n         |                                      |\n         \u25bc                                      |\n   id = qnodesp-\u003ecount++;                       |\n  (Note that nodes[0].lock == A)                |\n         |                                      |\n         \u25bc                                      |\n      Interrupt                                 |\n  (happens before \"nodes[0].lock = B\")          |\n         |                                      |\n         \u25bc                                      |\n  spin_lock_irqsave(A)                          |\n         |                                      |\n         \u25bc                                      |\n   id = qnodesp-\u003ecount++                        |\n   nodes[1].lock = A                            |\n         |                                      |\n         \u25bc                                      |\n  Tail of MCS queue                             |\n         |                             spin_lock_irqsave(A)\n         \u25bc                                      |\n  Head of MCS queue                             \u25bc\n         |                             CPU0 is previous tail\n         \u25bc                                      |\n   Spin indefinitely                            \u25bc\n  (until \"nodes[1].next != NULL\")      prev = get_tail_qnode(A, CPU0)\n                                                |\n                                                \u25bc\n                                       prev == \u0026qnodes[CPU0].nodes[0]\n                                     (as qnodes\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:36:43.772Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d84ab6661e8d09092de9b034b016515ef9b66085"
        },
        {
          "url": "https://git.kernel.org/stable/c/f06af737e4be28c0e926dc25d5f0a111da4e2987"
        },
        {
          "url": "https://git.kernel.org/stable/c/734ad0af3609464f8f93e00b6c0de1e112f44559"
        }
      ],
      "title": "powerpc/qspinlock: Fix deadlock in MCS queue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46797",
    "datePublished": "2024-09-18T07:12:51.795Z",
    "dateReserved": "2024-09-11T15:12:18.280Z",
    "dateUpdated": "2026-05-11T20:36:43.772Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46797",
      "date": "2026-07-20",
      "epss": "0.00163",
      "percentile": "0.05865"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.51\", \"matchCriteriaId\": \"E4529134-BAC4-4776-840B-304009E181A0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.10\", \"matchCriteriaId\": \"ACDEE48C-137A-4731-90D0-A675865E1BED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0005AEF-856E-47EB-BFE4-90C46899394D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"39889A68-6D34-47A6-82FC-CD0BF23D6754\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\npowerpc/qspinlock: Fix deadlock in MCS queue\\n\\nIf an interrupt occurs in queued_spin_lock_slowpath() after we increment\\nqnodesp-\u003ecount and before node-\u003elock is initialized, another CPU might\\nsee stale lock values in get_tail_qnode(). If the stale lock value happens\\nto match the lock on that CPU, then we write to the \\\"next\\\" pointer of\\nthe wrong qnode. This causes a deadlock as the former CPU, once it becomes\\nthe head of the MCS queue, will spin indefinitely until it\u0027s \\\"next\\\" pointer\\nis set by its successor in the queue.\\n\\nRunning stress-ng on a 16 core (16EC/16VP) shared LPAR, results in\\noccasional lockups similar to the following:\\n\\n   $ stress-ng --all 128 --vm-bytes 80% --aggressive \\\\\\n               --maximize --oomable --verify  --syslog \\\\\\n               --metrics  --times  --timeout 5m\\n\\n   watchdog: CPU 15 Hard LOCKUP\\n   ......\\n   NIP [c0000000000b78f4] queued_spin_lock_slowpath+0x1184/0x1490\\n   LR [c000000001037c5c] _raw_spin_lock+0x6c/0x90\\n   Call Trace:\\n    0xc000002cfffa3bf0 (unreliable)\\n    _raw_spin_lock+0x6c/0x90\\n    raw_spin_rq_lock_nested.part.135+0x4c/0xd0\\n    sched_ttwu_pending+0x60/0x1f0\\n    __flush_smp_call_function_queue+0x1dc/0x670\\n    smp_ipi_demux_relaxed+0xa4/0x100\\n    xive_muxed_ipi_action+0x20/0x40\\n    __handle_irq_event_percpu+0x80/0x240\\n    handle_irq_event_percpu+0x2c/0x80\\n    handle_percpu_irq+0x84/0xd0\\n    generic_handle_irq+0x54/0x80\\n    __do_irq+0xac/0x210\\n    __do_IRQ+0x74/0xd0\\n    0x0\\n    do_IRQ+0x8c/0x170\\n    hardware_interrupt_common_virt+0x29c/0x2a0\\n   --- interrupt: 500 at queued_spin_lock_slowpath+0x4b8/0x1490\\n   ......\\n   NIP [c0000000000b6c28] queued_spin_lock_slowpath+0x4b8/0x1490\\n   LR [c000000001037c5c] _raw_spin_lock+0x6c/0x90\\n   --- interrupt: 500\\n    0xc0000029c1a41d00 (unreliable)\\n    _raw_spin_lock+0x6c/0x90\\n    futex_wake+0x100/0x260\\n    do_futex+0x21c/0x2a0\\n    sys_futex+0x98/0x270\\n    system_call_exception+0x14c/0x2f0\\n    system_call_vectored_common+0x15c/0x2ec\\n\\nThe following code flow illustrates how the deadlock occurs.\\nFor the sake of brevity, assume that both locks (A and B) are\\ncontended and we call the queued_spin_lock_slowpath() function.\\n\\n        CPU0                                   CPU1\\n        ----                                   ----\\n  spin_lock_irqsave(A)                          |\\n  spin_unlock_irqrestore(A)                     |\\n    spin_lock(B)                                |\\n         |                                      |\\n         \\u25bc                                      |\\n   id = qnodesp-\u003ecount++;                       |\\n  (Note that nodes[0].lock == A)                |\\n         |                                      |\\n         \\u25bc                                      |\\n      Interrupt                                 |\\n  (happens before \\\"nodes[0].lock = B\\\")          |\\n         |                                      |\\n         \\u25bc                                      |\\n  spin_lock_irqsave(A)                          |\\n         |                                      |\\n         \\u25bc                                      |\\n   id = qnodesp-\u003ecount++                        |\\n   nodes[1].lock = A                            |\\n         |                                      |\\n         \\u25bc                                      |\\n  Tail of MCS queue                             |\\n         |                             spin_lock_irqsave(A)\\n         \\u25bc                                      |\\n  Head of MCS queue                             \\u25bc\\n         |                             CPU0 is previous tail\\n         \\u25bc                                      |\\n   Spin indefinitely                            \\u25bc\\n  (until \\\"nodes[1].next != NULL\\\")      prev = get_tail_qnode(A, CPU0)\\n                                                |\\n                                                \\u25bc\\n                                       prev == \u0026qnodes[CPU0].nodes[0]\\n                                     (as qnodes\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: powerpc/qspinlock: Se corrige el bloqueo en la cola MCS Si se produce una interrupci\\u00f3n en queued_spin_lock_slowpath() despu\\u00e9s de que incrementamos qnodesp-\u0026gt;count y antes de que se inicialice node-\u0026gt;lock, otra CPU podr\\u00eda ver valores de bloqueo obsoletos en get_tail_qnode(). Si el valor de bloqueo obsoleto coincide con el bloqueo en esa CPU, entonces escribimos en el puntero \\\"siguiente\\\" del qnode incorrecto. Esto provoca un bloqueo ya que la CPU anterior, una vez que se convierte en la cabeza de la cola MCS, girar\\u00e1 indefinidamente hasta que su puntero \\\"siguiente\\\" sea establecido por su sucesor en la cola. Al ejecutar stress-ng en una LPAR compartida de 16 n\\u00facleos (16EC/16VP), se producen bloqueos ocasionales similares a los siguientes: $ stress-ng --all 128 --vm-bytes 80% --aggressive \\\\ --maximize --oomable --verify --syslog \\\\ --metrics --times --timeout 5m watchdog: CPU 15 Hard LOCKUP ...... NIP [c0000000000b78f4] queued_spin_lock_slowpath+0x1184/0x1490 LR [c000000001037c5c] _raw_spin_lock+0x6c/0x90 Seguimiento de llamadas: 0xc000002cfffa3bf0 (no confiable) _raw_spin_lock+0x6c/0x90 bloqueo_de_rq_de_spin_sin_formato_anidado.parte.135+0x4c/0xd0 pendiente_programa_de_programaci\\u00f3n_pendiente+0x60/0x1f0 __vaciado_cola_de_funciones_de_llamada_smp+0x1dc/0x670 smp_ipi_demux_relajado+0xa4/0x100 acci\\u00f3n_ipi_muxed_xive+0x20/0x40 __controlador_evento_irq_percpu+0x80/0x240 control_evento_irq_percpu+0x2c/0x80 control_percpu_irq+0x84/0xd0 control_irq_gen\\u00e9rico+0x54/0x80 __do_irq+0xac/0x210 __do_IRQ+0x74/0xd0 0x0 do_IRQ+0x8c/0x170 interrupci\\u00f3n_de_hardware_virt_com\\u00fan+0x29c/0x2a0 --- interrupci\\u00f3n: 500 en ruta_lenta_bloqueo_de_giro_en_cola+0x4b8/0x1490 ...... NIP [c0000000000b6c28] ruta_lenta_bloqueo_de_giro_en_cola+0x4b8/0x1490 LR [c000000001037c5c] _bloqueo_de_giro_en_cola+0x6c/0x90 --- interrupci\\u00f3n: 500 0xc0000029c1a41d00 (no confiable) _bloqueo_de_giro_en_cola+0x6c/0x90 futex_wake+0x100/0x260 do_futex+0x21c/0x2a0 sys_futex+0x98/0x270 system_call_exception+0x14c/0x2f0 system_call_vectored_common+0x15c/0x2ec El siguiente flujo de c\\u00f3digo ilustra c\\u00f3mo se produce el interbloqueo. Para abreviar, supongamos que ambos bloqueos (A y B) est\\u00e1n en conflicto y llamamos a la funci\\u00f3n queued_spin_lock_slowpath(). CPU0 CPU1 ---- ---- spin_lock_irqsave(A) | spin_unlock_irqrestore(A) | spin_lock(B) | | | ? | id = qnodesp-\u0026gt;count++; | (Tenga en cuenta que nodes[0].lock == A) | | | ? | Interrupci\\u00f3n | (sucede antes de \\\"nodes[0].lock = B\\\") | | | ? | spin_lock_irqsave(A) | | | ? | id = qnodesp-\u0026gt;count++ | nodes[1].lock = A | | | ? | Cola de la cola MCS | | spin_lock_irqsave(A) ? | Cabecera de la cola MCS ? | CPU0 es la cola anterior ? | Girar indefinidamente ? (hasta que \\\"nodes[1].next != NULL\\\") prev = get_tail_qnode(A, CPU0) | ? prev == \u0026amp;qnodes[CPU0].nodes[0] (como qnodes ---truncados---\"}]",
      "id": "CVE-2024-46797",
      "lastModified": "2024-09-29T15:15:15.837",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-09-18T08:15:06.403",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/734ad0af3609464f8f93e00b6c0de1e112f44559\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d84ab6661e8d09092de9b034b016515ef9b66085\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f06af737e4be28c0e926dc25d5f0a111da4e2987\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-667\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T02:07:42.000Z",
      "cve": "CVE-2024-46797",
      "id": "msrc_CVE-2024-46797",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "powerpc/qspinlock: Fix deadlock in MCS queue",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-46797.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46797\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-18T08:15:06.403\",\"lastModified\":\"2026-06-17T07:55:57.253\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npowerpc/qspinlock: Fix deadlock in MCS queue\\n\\nIf an interrupt occurs in queued_spin_lock_slowpath() after we increment\\nqnodesp-\u003ecount and before node-\u003elock is initialized, another CPU might\\nsee stale lock values in get_tail_qnode(). If the stale lock value happens\\nto match the lock on that CPU, then we write to the \\\"next\\\" pointer of\\nthe wrong qnode. This causes a deadlock as the former CPU, once it becomes\\nthe head of the MCS queue, will spin indefinitely until it\u0027s \\\"next\\\" pointer\\nis set by its successor in the queue.\\n\\nRunning stress-ng on a 16 core (16EC/16VP) shared LPAR, results in\\noccasional lockups similar to the following:\\n\\n   $ stress-ng --all 128 --vm-bytes 80% --aggressive \\\\\\n               --maximize --oomable --verify  --syslog \\\\\\n               --metrics  --times  --timeout 5m\\n\\n   watchdog: CPU 15 Hard LOCKUP\\n   ......\\n   NIP [c0000000000b78f4] queued_spin_lock_slowpath+0x1184/0x1490\\n   LR [c000000001037c5c] _raw_spin_lock+0x6c/0x90\\n   Call Trace:\\n    0xc000002cfffa3bf0 (unreliable)\\n    _raw_spin_lock+0x6c/0x90\\n    raw_spin_rq_lock_nested.part.135+0x4c/0xd0\\n    sched_ttwu_pending+0x60/0x1f0\\n    __flush_smp_call_function_queue+0x1dc/0x670\\n    smp_ipi_demux_relaxed+0xa4/0x100\\n    xive_muxed_ipi_action+0x20/0x40\\n    __handle_irq_event_percpu+0x80/0x240\\n    handle_irq_event_percpu+0x2c/0x80\\n    handle_percpu_irq+0x84/0xd0\\n    generic_handle_irq+0x54/0x80\\n    __do_irq+0xac/0x210\\n    __do_IRQ+0x74/0xd0\\n    0x0\\n    do_IRQ+0x8c/0x170\\n    hardware_interrupt_common_virt+0x29c/0x2a0\\n   --- interrupt: 500 at queued_spin_lock_slowpath+0x4b8/0x1490\\n   ......\\n   NIP [c0000000000b6c28] queued_spin_lock_slowpath+0x4b8/0x1490\\n   LR [c000000001037c5c] _raw_spin_lock+0x6c/0x90\\n   --- interrupt: 500\\n    0xc0000029c1a41d00 (unreliable)\\n    _raw_spin_lock+0x6c/0x90\\n    futex_wake+0x100/0x260\\n    do_futex+0x21c/0x2a0\\n    sys_futex+0x98/0x270\\n    system_call_exception+0x14c/0x2f0\\n    system_call_vectored_common+0x15c/0x2ec\\n\\nThe following code flow illustrates how the deadlock occurs.\\nFor the sake of brevity, assume that both locks (A and B) are\\ncontended and we call the queued_spin_lock_slowpath() function.\\n\\n        CPU0                                   CPU1\\n        ----                                   ----\\n  spin_lock_irqsave(A)                          |\\n  spin_unlock_irqrestore(A)                     |\\n    spin_lock(B)                                |\\n         |                                      |\\n         \u25bc                                      |\\n   id = qnodesp-\u003ecount++;                       |\\n  (Note that nodes[0].lock == A)                |\\n         |                                      |\\n         \u25bc                                      |\\n      Interrupt                                 |\\n  (happens before \\\"nodes[0].lock = B\\\")          |\\n         |                                      |\\n         \u25bc                                      |\\n  spin_lock_irqsave(A)                          |\\n         |                                      |\\n         \u25bc                                      |\\n   id = qnodesp-\u003ecount++                        |\\n   nodes[1].lock = A                            |\\n         |                                      |\\n         \u25bc                                      |\\n  Tail of MCS queue                             |\\n         |                             spin_lock_irqsave(A)\\n         \u25bc                                      |\\n  Head of MCS queue                             \u25bc\\n         |                             CPU0 is previous tail\\n         \u25bc                                      |\\n   Spin indefinitely                            \u25bc\\n  (until \\\"nodes[1].next != NULL\\\")      prev = get_tail_qnode(A, CPU0)\\n                                                |\\n                                                \u25bc\\n                                       prev == \u0026qnodes[CPU0].nodes[0]\\n                                     (as qnodes\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: powerpc/qspinlock: Se corrige el bloqueo en la cola MCS Si se produce una interrupci\u00f3n en queued_spin_lock_slowpath() despu\u00e9s de que incrementamos qnodesp-\u0026gt;count y antes de que se inicialice node-\u0026gt;lock, otra CPU podr\u00eda ver valores de bloqueo obsoletos en get_tail_qnode(). Si el valor de bloqueo obsoleto coincide con el bloqueo en esa CPU, entonces escribimos en el puntero \\\"siguiente\\\" del qnode incorrecto. Esto provoca un bloqueo ya que la CPU anterior, una vez que se convierte en la cabeza de la cola MCS, girar\u00e1 indefinidamente hasta que su puntero \\\"siguiente\\\" sea establecido por su sucesor en la cola. Al ejecutar stress-ng en una LPAR compartida de 16 n\u00facleos (16EC/16VP), se producen bloqueos ocasionales similares a los siguientes: $ stress-ng --all 128 --vm-bytes 80% --aggressive \\\\ --maximize --oomable --verify --syslog \\\\ --metrics --times --timeout 5m watchdog: CPU 15 Hard LOCKUP ...... NIP [c0000000000b78f4] queued_spin_lock_slowpath+0x1184/0x1490 LR [c000000001037c5c] _raw_spin_lock+0x6c/0x90 Seguimiento de llamadas: 0xc000002cfffa3bf0 (no confiable) _raw_spin_lock+0x6c/0x90 bloqueo_de_rq_de_spin_sin_formato_anidado.parte.135+0x4c/0xd0 pendiente_programa_de_programaci\u00f3n_pendiente+0x60/0x1f0 __vaciado_cola_de_funciones_de_llamada_smp+0x1dc/0x670 smp_ipi_demux_relajado+0xa4/0x100 acci\u00f3n_ipi_muxed_xive+0x20/0x40 __controlador_evento_irq_percpu+0x80/0x240 control_evento_irq_percpu+0x2c/0x80 control_percpu_irq+0x84/0xd0 control_irq_gen\u00e9rico+0x54/0x80 __do_irq+0xac/0x210 __do_IRQ+0x74/0xd0 0x0 do_IRQ+0x8c/0x170 interrupci\u00f3n_de_hardware_virt_com\u00fan+0x29c/0x2a0 --- interrupci\u00f3n: 500 en ruta_lenta_bloqueo_de_giro_en_cola+0x4b8/0x1490 ...... NIP [c0000000000b6c28] ruta_lenta_bloqueo_de_giro_en_cola+0x4b8/0x1490 LR [c000000001037c5c] _bloqueo_de_giro_en_cola+0x6c/0x90 --- interrupci\u00f3n: 500 0xc0000029c1a41d00 (no confiable) _bloqueo_de_giro_en_cola+0x6c/0x90 futex_wake+0x100/0x260 do_futex+0x21c/0x2a0 sys_futex+0x98/0x270 system_call_exception+0x14c/0x2f0 system_call_vectored_common+0x15c/0x2ec El siguiente flujo de c\u00f3digo ilustra c\u00f3mo se produce el interbloqueo. Para abreviar, supongamos que ambos bloqueos (A y B) est\u00e1n en conflicto y llamamos a la funci\u00f3n queued_spin_lock_slowpath(). CPU0 CPU1 ---- ---- spin_lock_irqsave(A) | spin_unlock_irqrestore(A) | spin_lock(B) | | | ? | id = qnodesp-\u0026gt;count++; | (Tenga en cuenta que nodes[0].lock == A) | | | ? | Interrupci\u00f3n | (sucede antes de \\\"nodes[0].lock = B\\\") | | | ? | spin_lock_irqsave(A) | | | ? | id = qnodesp-\u0026gt;count++ | nodes[1].lock = A | | | ? | Cola de la cola MCS | | spin_lock_irqsave(A) ? | Cabecera de la cola MCS ? | CPU0 es la cola anterior ? | Girar indefinidamente ? (hasta que \\\"nodes[1].next != NULL\\\") prev = get_tail_qnode(A, CPU0) | ? prev == \u0026amp;qnodes[CPU0].nodes[0] (como qnodes ---truncados---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/powerpc/lib/qspinlock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"84990b169557428c318df87b7836cd15f65b62dc\",\"lessThan\":\"d84ab6661e8d09092de9b034b016515ef9b66085\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"84990b169557428c318df87b7836cd15f65b62dc\",\"lessThan\":\"f06af737e4be28c0e926dc25d5f0a111da4e2987\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"84990b169557428c318df87b7836cd15f65b62dc\",\"lessThan\":\"734ad0af3609464f8f93e00b6c0de1e112f44559\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/powerpc/lib/qspinlock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.51\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.10\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T14:22:25.653688Z\",\"id\":\"CVE-2024-46797\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.51\",\"matchCriteriaId\":\"E4529134-BAC4-4776-840B-304009E181A0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.10\",\"matchCriteriaId\":\"ACDEE48C-137A-4731-90D0-A675865E1BED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/734ad0af3609464f8f93e00b6c0de1e112f44559\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d84ab6661e8d09092de9b034b016515ef9b66085\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f06af737e4be28c0e926dc25d5f0a111da4e2987\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T14:33:09+00:00",
      "cve": "CVE-2024-46797",
      "id": "CVE-2024-46797",
      "initial_release_date": "2024-09-18T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: powerpc/qspinlock: Fix deadlock in MCS queue",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46797.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-19T17:56:31Z",
      "cve": "CVE-2024-46797",
      "id": "CVE-2024-46797",
      "initial_release_date": "2025-09-22T23:33:04Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "263",
      "product_status:recommended": "377",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-46797",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-46797.json",
      "version": "16"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46797\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T14:22:25.653688Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T14:22:27.114Z\"}}], \"cna\": {\"title\": \"powerpc/qspinlock: Fix deadlock in MCS queue\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"84990b169557\", \"lessThan\": \"d84ab6661e8d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"84990b169557\", \"lessThan\": \"f06af737e4be\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"84990b169557\", \"lessThan\": \"734ad0af3609\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/powerpc/lib/qspinlock.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.51\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/powerpc/lib/qspinlock.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d84ab6661e8d09092de9b034b016515ef9b66085\"}, {\"url\": \"https://git.kernel.org/stable/c/f06af737e4be28c0e926dc25d5f0a111da4e2987\"}, {\"url\": \"https://git.kernel.org/stable/c/734ad0af3609464f8f93e00b6c0de1e112f44559\"}], \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\npowerpc/qspinlock: Fix deadlock in MCS queue\\n\\nIf an interrupt occurs in queued_spin_lock_slowpath() after we increment\\nqnodesp-\u003ecount and before node-\u003elock is initialized, another CPU might\\nsee stale lock values in get_tail_qnode(). If the stale lock value happens\\nto match the lock on that CPU, then we write to the \\\"next\\\" pointer of\\nthe wrong qnode. This causes a deadlock as the former CPU, once it becomes\\nthe head of the MCS queue, will spin indefinitely until it\u0027s \\\"next\\\" pointer\\nis set by its successor in the queue.\\n\\nRunning stress-ng on a 16 core (16EC/16VP) shared LPAR, results in\\noccasional lockups similar to the following:\\n\\n   $ stress-ng --all 128 --vm-bytes 80% --aggressive \\\\\\n               --maximize --oomable --verify  --syslog \\\\\\n               --metrics  --times  --timeout 5m\\n\\n   watchdog: CPU 15 Hard LOCKUP\\n   ......\\n   NIP [c0000000000b78f4] queued_spin_lock_slowpath+0x1184/0x1490\\n   LR [c000000001037c5c] _raw_spin_lock+0x6c/0x90\\n   Call Trace:\\n    0xc000002cfffa3bf0 (unreliable)\\n    _raw_spin_lock+0x6c/0x90\\n    raw_spin_rq_lock_nested.part.135+0x4c/0xd0\\n    sched_ttwu_pending+0x60/0x1f0\\n    __flush_smp_call_function_queue+0x1dc/0x670\\n    smp_ipi_demux_relaxed+0xa4/0x100\\n    xive_muxed_ipi_action+0x20/0x40\\n    __handle_irq_event_percpu+0x80/0x240\\n    handle_irq_event_percpu+0x2c/0x80\\n    handle_percpu_irq+0x84/0xd0\\n    generic_handle_irq+0x54/0x80\\n    __do_irq+0xac/0x210\\n    __do_IRQ+0x74/0xd0\\n    0x0\\n    do_IRQ+0x8c/0x170\\n    hardware_interrupt_common_virt+0x29c/0x2a0\\n   --- interrupt: 500 at queued_spin_lock_slowpath+0x4b8/0x1490\\n   ......\\n   NIP [c0000000000b6c28] queued_spin_lock_slowpath+0x4b8/0x1490\\n   LR [c000000001037c5c] _raw_spin_lock+0x6c/0x90\\n   --- interrupt: 500\\n    0xc0000029c1a41d00 (unreliable)\\n    _raw_spin_lock+0x6c/0x90\\n    futex_wake+0x100/0x260\\n    do_futex+0x21c/0x2a0\\n    sys_futex+0x98/0x270\\n    system_call_exception+0x14c/0x2f0\\n    system_call_vectored_common+0x15c/0x2ec\\n\\nThe following code flow illustrates how the deadlock occurs.\\nFor the sake of brevity, assume that both locks (A and B) are\\ncontended and we call the queued_spin_lock_slowpath() function.\\n\\n        CPU0                                   CPU1\\n        ----                                   ----\\n  spin_lock_irqsave(A)                          |\\n  spin_unlock_irqrestore(A)                     |\\n    spin_lock(B)                                |\\n         |                                      |\\n         \\u25bc                                      |\\n   id = qnodesp-\u003ecount++;                       |\\n  (Note that nodes[0].lock == A)                |\\n         |                                      |\\n         \\u25bc                                      |\\n      Interrupt                                 |\\n  (happens before \\\"nodes[0].lock = B\\\")          |\\n         |                                      |\\n         \\u25bc                                      |\\n  spin_lock_irqsave(A)                          |\\n         |                                      |\\n         \\u25bc                                      |\\n   id = qnodesp-\u003ecount++                        |\\n   nodes[1].lock = A                            |\\n         |                                      |\\n         \\u25bc                                      |\\n  Tail of MCS queue                             |\\n         |                             spin_lock_irqsave(A)\\n         \\u25bc                                      |\\n  Head of MCS queue                             \\u25bc\\n         |                             CPU0 is previous tail\\n         \\u25bc                                      |\\n   Spin indefinitely                            \\u25bc\\n  (until \\\"nodes[1].next != NULL\\\")      prev = get_tail_qnode(A, CPU0)\\n                                                |\\n                                                \\u25bc\\n                                       prev == \u0026qnodes[CPU0].nodes[0]\\n                                     (as qnodes\\n---truncated---\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-05T09:46:49.128Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46797\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-05T09:46:49.128Z\", \"dateReserved\": \"2024-09-11T15:12:18.280Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-18T07:12:51.795Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.