CVE-2024-27009 - Fixing Race Condition in s390/cio during Online Processing in Linux Kernel

The Linux Kernel is an open-source, Unix-like operating system kernel, and it's the core of the Linux operating system. A significant vulnerability, CVE-2024-27009, has been resolved in the s390/cio component of the Linux Kernel. The vulnerability concerns a race condition in the online processing of a Common I/O (CIO) device in the s390 architecture. This article aims to provide detailed information about the vulnerability, its potential impact, and the solution to mitigate this issue.

CVE-2024-27009 - Vulnerability Details

s390/cio is an architecture-specific component of the Linux kernel handling Common I/O (CIO) devices. As per the issue description, a race condition exists in the ccw_device_set_online() function, which can result in online processing failure. This leaves the affected device in an inconsistent state and prevents subsequent attempts to set the device online (returning ENODEV error code).

The problem occurs when a path verification request arrives after a wait_for_final_state() operation completion but before the result state is evaluated. This issue has been further exacerbated by commit [2297791c92d]("s390/cio: don't unregister subchannel from child-drivers") which increased the likelihood of path verification requests during the boot process, making the race condition more common.

Exploitation of CVE-2024-27009

A successful exploitation of this vulnerability could cause a denial of service (DoS) attack, making the Linux Kernel unresponsive and eventually crashing the system. It's important to understand that this vulnerability is not related to any remote code execution (RCE) or privilege escalation. However, as a critical part of the system, ensuring the operational functionality of the Linux Kernel is essential.

Mitigation for CVE-2024-27009

To fix this vulnerability, developers must ensure that the CCW-device lock is held between determining the final state and checking the result state. The following code snippet demonstrates how to correctly apply this fix:

--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -1047,8 +1047,10 @@ static int ccw_device_set_online(struct ccw_device *cdev)
                return retval;
        }
 
-       if (cdev->private->state != DEV_STATE_ONLINE)
+       spin_lock_irq(cdev->ccwlock);
+       if (cdev->private->state != DEV_STATE_ONLINE) {
+               spin_unlock_irq(cdev->ccwlock);
                return -ENODEV;
+       }
        ccw_device_allow_force(cdev, );
        printk(KERN_WARNING "Enabling device %s\n", dev_name(&cdev->dev));

Original References

- Issue Description: https://www.spinics.net/lists/linux/msg453124.html
- Patch for Resolution: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/s390/cio/device.c?id=a807b194ddaf4eca73df8ca84e3ebf960c69a

Conclusion

The resolution of this vulnerability (CVE-2024-27009) in the Linux Kernel's s390/cio component highlights the importance of community collaboration in open-source software development. As more instances of race condition issues are identified and fixed, the Linux Kernel will continue to be a more secure and reliable operating system for users and organizations alike.

Timeline

Published on: 05/01/2024 06:15:19 UTC
Last modified on: 05/29/2024 05:26:56 UTC