CVE-2024-35968

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-35968", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.140Z", "datePublished": "2024-05-20T09:41:57.162Z", "dateUpdated": "2026-08-05T11:31:17.459Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:31:17.459Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: Fix pdsc_check_pci_health function to use work thread\n\nWhen the driver notices fw_status == 0xff it tries to perform a PCI\nreset on itself via pci_reset_function() in the context of the driver's\nhealth thread. However, pdsc_reset_prepare calls\npdsc_stop_health_thread(), which attempts to stop/flush the health\nthread. This results in a deadlock because the stop/flush will never\ncomplete since the driver called pci_reset_function() from the health\nthread context. Fix by changing the pdsc_check_pci_health_function()\nto queue a newly introduced pdsc_pci_reset_thread() on the pdsc's\nwork queue.\n\nUnloading the driver in the fw_down/dead state uncovered another issue,\nwhich can be seen in the following trace:\n\nWARNING: CPU: 51 PID: 6914 at kernel/workqueue.c:1450 __queue_work+0x358/0x440\n[...]\nRIP: 0010:__queue_work+0x358/0x440\n[...]\nCall Trace:\n <TASK>\n ? __warn+0x85/0x140\n ? __queue_work+0x358/0x440\n ? report_bug+0xfc/0x1e0\n ? handle_bug+0x3f/0x70\n ? exc_invalid_op+0x17/0x70\n ? asm_exc_invalid_op+0x1a/0x20\n ? __queue_work+0x358/0x440\n queue_work_on+0x28/0x30\n pdsc_devcmd_locked+0x96/0xe0 [pds_core]\n pdsc_devcmd_reset+0x71/0xb0 [pds_core]\n pdsc_teardown+0x51/0xe0 [pds_core]\n pdsc_remove+0x106/0x200 [pds_core]\n pci_device_remove+0x37/0xc0\n device_release_driver_internal+0xae/0x140\n driver_detach+0x48/0x90\n bus_remove_driver+0x6d/0xf0\n pci_unregister_driver+0x2e/0xa0\n pdsc_cleanup_module+0x10/0x780 [pds_core]\n __x64_sys_delete_module+0x142/0x2b0\n ? syscall_trace_enter.isra.18+0x126/0x1a0\n do_syscall_64+0x3b/0x90\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\nRIP: 0033:0x7fbd9d03a14b\n[...]\n\nFix this by preventing the devcmd reset if the FW is not running."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is a PCI device driver health/watchdog path driven by a kernel timer and MMIO register reads, with trigger surfaces limited to local interfaces (sysfs PCI reset/unbind, devlink, module unload, adminq/aux-bus clients such as a pds_vdpa guest). No remote or adjacent network data reaches this path.\nAC:L - Once the driver observes the bad-PCI status the deadlock is unconditional \u2014 `cancel_work_sync()` on the running work item is a deterministic self-deadlock, with no race to win and no memory-layout dependency; the unload-with-dead-FW path that reaches `queue_work()` on the freed workqueue is likewise deterministic because the devcmd always times out in that state.\nPR:L - The health thread executes autonomously from a 5-second kernel timer with no privilege involved, and low-privileged local actors that can drive the device \u2014 an aux-bus/adminq client or a guest using a passed-through PDS VF \u2014 can force the adminq timeouts that immediately queue the health work.\nUI:N - No victim action is needed; the watchdog timer queues the health work automatically and the deadlock or the post-`destroy_workqueue()` `queue_work()` occurs without any interaction from another user.\nS:U - The deadlock, lock retention and use-after-free are all confined to the host kernel's own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - `queue_work()` on the freed `workqueue_struct` after `destroy_workqueue()` is a use-after-free that reads freed heap contents and follows a stale `wq->cpu_pwq` pointer, which under heap grooming yields an attacker-influenced read primitive into kernel memory.\nI:H - The same use-after-free proceeds to lock and perform a list insertion through the stale `pwq->pool` pointer, writing into a reallocated slab object \u2014 a controllable write primitive suitable for control-flow corruption.\nA:H - The self-deadlock permanently hangs the driver's single-threaded workqueue while holding `config_lock` plus the pdev and upstream-bridge `device_lock`s, blocking further resets, unbind, hotplug and removal on that bridge and leaving unkillable D-state tasks that only a reboot clears; the UAF additionally causes kernel crashes."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/amd/pds_core/core.c", "drivers/net/ethernet/amd/pds_core/core.h", "drivers/net/ethernet/amd/pds_core/dev.c", "drivers/net/ethernet/amd/pds_core/main.c"], "versions": [{"version": "1e18ec3e9d46e4ad2b6507c3bfc7f59e2ab449a2", "lessThan": "38407914d48273d7f8ab765b9243658afe1c3ab6", "status": "affected", "versionType": "git"}, {"version": "1e18ec3e9d46e4ad2b6507c3bfc7f59e2ab449a2", "lessThan": "81665adf25d28a00a986533f1d3a5df76b79cad9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/amd/pds_core/core.c", "drivers/net/ethernet/amd/pds_core/core.h", "drivers/net/ethernet/amd/pds_core/dev.c", "drivers/net/ethernet/amd/pds_core/main.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.7", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.8.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/38407914d48273d7f8ab765b9243658afe1c3ab6"}, {"url": "https://git.kernel.org/stable/c/81665adf25d28a00a986533f1d3a5df76b79cad9"}], "title": "pds_core: Fix pdsc_check_pci_health function to use work thread", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35968", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-21T15:11:50.638119Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:34:48.818Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:49.041Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/38407914d48273d7f8ab765b9243658afe1c3ab6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/81665adf25d28a00a986533f1d3a5df76b79cad9", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/38407914d48273d7f8ab765b9243658afe1c3ab6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/81665adf25d28a00a986533f1d3a5df76b79cad9", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:49.041Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-35968", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-21T15:11:50.638119Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:25.167Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "pds_core: Fix pdsc_check_pci_health function to use work thread", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is a PCI device driver health/watchdog path driven by a kernel timer and MMIO register reads, with trigger surfaces limited to local interfaces (sysfs PCI reset/unbind, devlink, module unload, adminq/aux-bus clients such as a pds_vdpa guest). No remote or adjacent network data reaches this path.\nAC:L - Once the driver observes the bad-PCI status the deadlock is unconditional \u2014 `cancel_work_sync()` on the running work item is a deterministic self-deadlock, with no race to win and no memory-layout dependency; the unload-with-dead-FW path that reaches `queue_work()` on the freed workqueue is likewise deterministic because the devcmd always times out in that state.\nPR:L - The health thread executes autonomously from a 5-second kernel timer with no privilege involved, and low-privileged local actors that can drive the device \u2014 an aux-bus/adminq client or a guest using a passed-through PDS VF \u2014 can force the adminq timeouts that immediately queue the health work.\nUI:N - No victim action is needed; the watchdog timer queues the health work automatically and the deadlock or the post-`destroy_workqueue()` `queue_work()` occurs without any interaction from another user.\nS:U - The deadlock, lock retention and use-after-free are all confined to the host kernel's own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - `queue_work()` on the freed `workqueue_struct` after `destroy_workqueue()` is a use-after-free that reads freed heap contents and follows a stale `wq->cpu_pwq` pointer, which under heap grooming yields an attacker-influenced read primitive into kernel memory.\nI:H - The same use-after-free proceeds to lock and perform a list insertion through the stale `pwq->pool` pointer, writing into a reallocated slab object \u2014 a controllable write primitive suitable for control-flow corruption.\nA:H - The self-deadlock permanently hangs the driver's single-threaded workqueue while holding `config_lock` plus the pdev and upstream-bridge `device_lock`s, blocking further resets, unbind, hotplug and removal on that bridge and leaving unkillable D-state tasks that only a reboot clears; the UAF additionally causes kernel crashes."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1e18ec3e9d46e4ad2b6507c3bfc7f59e2ab449a2", "lessThan": "38407914d48273d7f8ab765b9243658afe1c3ab6", "versionType": "git"}, {"status": "affected", "version": "1e18ec3e9d46e4ad2b6507c3bfc7f59e2ab449a2", "lessThan": "81665adf25d28a00a986533f1d3a5df76b79cad9", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/amd/pds_core/core.c", "drivers/net/ethernet/amd/pds_core/core.h", "drivers/net/ethernet/amd/pds_core/dev.c", "drivers/net/ethernet/amd/pds_core/main.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.8.7", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/amd/pds_core/core.c", "drivers/net/ethernet/amd/pds_core/core.h", "drivers/net/ethernet/amd/pds_core/dev.c", "drivers/net/ethernet/amd/pds_core/main.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/38407914d48273d7f8ab765b9243658afe1c3ab6"}, {"url": "https://git.kernel.org/stable/c/81665adf25d28a00a986533f1d3a5df76b79cad9"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: Fix pdsc_check_pci_health function to use work thread\n\nWhen the driver notices fw_status == 0xff it tries to perform a PCI\nreset on itself via pci_reset_function() in the context of the driver's\nhealth thread. However, pdsc_reset_prepare calls\npdsc_stop_health_thread(), which attempts to stop/flush the health\nthread. This results in a deadlock because the stop/flush will never\ncomplete since the driver called pci_reset_function() from the health\nthread context. Fix by changing the pdsc_check_pci_health_function()\nto queue a newly introduced pdsc_pci_reset_thread() on the pdsc's\nwork queue.\n\nUnloading the driver in the fw_down/dead state uncovered another issue,\nwhich can be seen in the following trace:\n\nWARNING: CPU: 51 PID: 6914 at kernel/workqueue.c:1450 __queue_work+0x358/0x440\n[...]\nRIP: 0010:__queue_work+0x358/0x440\n[...]\nCall Trace:\n <TASK>\n ? __warn+0x85/0x140\n ? __queue_work+0x358/0x440\n ? report_bug+0xfc/0x1e0\n ? handle_bug+0x3f/0x70\n ? exc_invalid_op+0x17/0x70\n ? asm_exc_invalid_op+0x1a/0x20\n ? __queue_work+0x358/0x440\n queue_work_on+0x28/0x30\n pdsc_devcmd_locked+0x96/0xe0 [pds_core]\n pdsc_devcmd_reset+0x71/0xb0 [pds_core]\n pdsc_teardown+0x51/0xe0 [pds_core]\n pdsc_remove+0x106/0x200 [pds_core]\n pci_device_remove+0x37/0xc0\n device_release_driver_internal+0xae/0x140\n driver_detach+0x48/0x90\n bus_remove_driver+0x6d/0xf0\n pci_unregister_driver+0x2e/0xa0\n pdsc_cleanup_module+0x10/0x780 [pds_core]\n __x64_sys_delete_module+0x142/0x2b0\n ? syscall_trace_enter.isra.18+0x126/0x1a0\n do_syscall_64+0x3b/0x90\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\nRIP: 0033:0x7fbd9d03a14b\n[...]\n\nFix this by preventing the devcmd reset if the FW is not running."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.7", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "6.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:31:17.459Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35968", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:31:17.459Z", "dateReserved": "2024-05-17T13:50:33.140Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-20T09:41:57.162Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/amd/pds_core/core.c", "drivers/net/ethernet/amd/pds_core/core.h", "drivers/net/ethernet/amd/pds_core/dev.c", "drivers/net/ethernet/amd/pds_core/main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "38407914d48273d7f8ab765b9243658afe1c3ab6", "status": "affected", "version": "1e18ec3e9d46e4ad2b6507c3bfc7f59e2ab449a2", "versionType": "git"}, {"lessThan": "81665adf25d28a00a986533f1d3a5df76b79cad9", "status": "affected", "version": "1e18ec3e9d46e4ad2b6507c3bfc7f59e2ab449a2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/amd/pds_core/core.c", "drivers/net/ethernet/amd/pds_core/core.h", "drivers/net/ethernet/amd/pds_core/dev.c", "drivers/net/ethernet/amd/pds_core/main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA039DA0-F81C-49F2-8BC2-CBBCF83EE6A4", "versionEndExcluding": "6.7", "versionStartIncluding": "6.6.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DA814412-CD30-4333-AA23-FB18D865BFD6", "versionEndExcluding": "6.8.7", "versionStartIncluding": "6.7.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*", "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*", "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: Fix pdsc_check_pci_health function to use work thread\n\nWhen the driver notices fw_status == 0xff it tries to perform a PCI\nreset on itself via pci_reset_function() in the context of the driver's\nhealth thread. However, pdsc_reset_prepare calls\npdsc_stop_health_thread(), which attempts to stop/flush the health\nthread. This results in a deadlock because the stop/flush will never\ncomplete since the driver called pci_reset_function() from the health\nthread context. Fix by changing the pdsc_check_pci_health_function()\nto queue a newly introduced pdsc_pci_reset_thread() on the pdsc's\nwork queue.\n\nUnloading the driver in the fw_down/dead state uncovered another issue,\nwhich can be seen in the following trace:\n\nWARNING: CPU: 51 PID: 6914 at kernel/workqueue.c:1450 __queue_work+0x358/0x440\n[...]\nRIP: 0010:__queue_work+0x358/0x440\n[...]\nCall Trace:\n <TASK>\n ? __warn+0x85/0x140\n ? __queue_work+0x358/0x440\n ? report_bug+0xfc/0x1e0\n ? handle_bug+0x3f/0x70\n ? exc_invalid_op+0x17/0x70\n ? asm_exc_invalid_op+0x1a/0x20\n ? __queue_work+0x358/0x440\n queue_work_on+0x28/0x30\n pdsc_devcmd_locked+0x96/0xe0 [pds_core]\n pdsc_devcmd_reset+0x71/0xb0 [pds_core]\n pdsc_teardown+0x51/0xe0 [pds_core]\n pdsc_remove+0x106/0x200 [pds_core]\n pci_device_remove+0x37/0xc0\n device_release_driver_internal+0xae/0x140\n driver_detach+0x48/0x90\n bus_remove_driver+0x6d/0xf0\n pci_unregister_driver+0x2e/0xa0\n pdsc_cleanup_module+0x10/0x780 [pds_core]\n __x64_sys_delete_module+0x142/0x2b0\n ? syscall_trace_enter.isra.18+0x126/0x1a0\n do_syscall_64+0x3b/0x90\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\nRIP: 0033:0x7fbd9d03a14b\n[...]\n\nFix this by preventing the devcmd reset if the FW is not running."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: pds_core: corrige la funci\u00f3n pdsc_check_pci_health para usar el subproceso de trabajo. Cuando el controlador nota fw_status == 0xff, intenta realizar un restablecimiento de PCI sobre s\u00ed mismo a trav\u00e9s de pci_reset_function() en el contexto del subproceso de estado del controlador. . Sin embargo, pdsc_reset_prepare llama a pdsc_stop_health_thread(), que intenta detener/vaciar el hilo de salud. Esto da como resultado un punto muerto porque la parada/vaciado nunca se completar\u00e1 ya que el controlador llam\u00f3 a pci_reset_function() desde el contexto del hilo de salud. Para solucionarlo, cambie pdsc_check_pci_health_function() para poner en cola un pdsc_pci_reset_thread() reci\u00e9n introducido en la cola de trabajo del pdsc. La descarga del controlador en el estado fw_down/dead descubri\u00f3 otro problema, que se puede ver en el siguiente seguimiento: ADVERTENCIA: CPU: 51 PID: 6914 en kernel/workqueue.c:1450 __queue_work+0x358/0x440 [...] RIP: 0010:__queue_work+0x358/0x440 [...] Seguimiento de llamadas: ? __warn+0x85/0x140 ? __queue_work+0x358/0x440? report_bug+0xfc/0x1e0? handle_bug+0x3f/0x70? exc_invalid_op+0x17/0x70? asm_exc_invalid_op+0x1a/0x20? __queue_work+0x358/0x440 queue_work_on+0x28/0x30 pdsc_devcmd_locked+0x96/0xe0 [pds_core] pdsc_devcmd_reset+0x71/0xb0 [pds_core] pdsc_teardown+0x51/0xe0 [pds_core] pdsc_remove+0x106/0x200 [pds_core] pci_device_remove+0x37/0xc0 device_release_driver_internal+0xae /0x140 driver_detach+0x48/0x90 bus_remove_driver+0x6d/0xf0 pci_unregister_driver+0x2e/0xa0 pdsc_cleanup_module+0x10/0x780 [pds_core] __x64_sys_delete_module+0x142/0x2b0 ? syscall_trace_enter.isra.18+0x126/0x1a0 do_syscall_64+0x3b/0x90 Entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7fbd9d03a14b [...] Solucione este problema evitando que devcmd se reinicie si el FW no se est\u00e1 ejecutando."}], "id": "CVE-2024-35968", "lastModified": "2026-08-04T11:18:16.620", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-35968", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-21T15:11:50.638119Z", "version": "2.0.3"}}]}, "published": "2024-05-20T10:15:11.713", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/38407914d48273d7f8ab765b9243658afe1c3ab6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/81665adf25d28a00a986533f1d3a5df76b79cad9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/38407914d48273d7f8ab765b9243658afe1c3ab6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/81665adf25d28a00a986533f1d3a5df76b79cad9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: pds_core: Fix pdsc_check_pci_health function to use work thread", "id": "2281903", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281903"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\npds_core: Fix pdsc_check_pci_health function to use work thread\nWhen the driver notices fw_status == 0xff it tries to perform a PCI\nreset on itself via pci_reset_function() in the context of the driver's\nhealth thread. However, pdsc_reset_prepare calls\npdsc_stop_health_thread(), which attempts to stop/flush the health\nthread. This results in a deadlock because the stop/flush will never\ncomplete since the driver called pci_reset_function() from the health\nthread context. Fix by changing the pdsc_check_pci_health_function()\nto queue a newly introduced pdsc_pci_reset_thread() on the pdsc's\nwork queue.\nUnloading the driver in the fw_down/dead state uncovered another issue,\nwhich can be seen in the following trace:\nWARNING: CPU: 51 PID: 6914 at kernel/workqueue.c:1450 __queue_work+0x358/0x440\n[...]\nRIP: 0010:__queue_work+0x358/0x440\n[...]\nCall Trace:\n<TASK>\n? __warn+0x85/0x140\n? __queue_work+0x358/0x440\n? report_bug+0xfc/0x1e0\n? handle_bug+0x3f/0x70\n? exc_invalid_op+0x17/0x70\n? asm_exc_invalid_op+0x1a/0x20\n? __queue_work+0x358/0x440\nqueue_work_on+0x28/0x30\npdsc_devcmd_locked+0x96/0xe0 [pds_core]\npdsc_devcmd_reset+0x71/0xb0 [pds_core]\npdsc_teardown+0x51/0xe0 [pds_core]\npdsc_remove+0x106/0x200 [pds_core]\npci_device_remove+0x37/0xc0\ndevice_release_driver_internal+0xae/0x140\ndriver_detach+0x48/0x90\nbus_remove_driver+0x6d/0xf0\npci_unregister_driver+0x2e/0xa0\npdsc_cleanup_module+0x10/0x780 [pds_core]\n__x64_sys_delete_module+0x142/0x2b0\n? syscall_trace_enter.isra.18+0x126/0x1a0\ndo_syscall_64+0x3b/0x90\nentry_SYSCALL_64_after_hwframe+0x72/0xdc\nRIP: 0033:0x7fbd9d03a14b\n[...]\nFix this by preventing the devcmd reset if the FW is not running.", "A vulnerability was found in the `pds_core` driver of the Linux kernel, introduced in version 6.8. The issue occurs when the driver attempts a PCI reset within its health thread, leading to a deadlock because the thread cannot stop while performing the reset."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-35968", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-35968\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-35968\nhttps://lore.kernel.org/linux-cve-announce/2024052022-CVE-2024-35968-80ae@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate"}

{}