In the Linux kernel, the following vulnerability has been resolved: pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER In create_pinctrl(), pinctrl_maps_mutex is acquired before calling add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl() calls pinctrl_free(). However, pinctrl_free() attempts to acquire pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to a potential deadlock. This patch resolves the issue by releasing pinctrl_maps_mutex before calling pinctrl_free(), preventing the deadlock. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://git.kernel.org/stable/c/01fe2f885f7813f8aed5d3704b384a97b1116a9e cve-icon cve-icon
https://git.kernel.org/stable/c/4038c57bf61631219b31f1bd6e92106ec7f084dc cve-icon cve-icon
https://git.kernel.org/stable/c/420ce1261907e5dbeda1e4daffd5b6c76f8188c0 cve-icon cve-icon
https://git.kernel.org/stable/c/48a7a7c9571c3e62f17012dd7f2063e926179ddd cve-icon cve-icon
https://git.kernel.org/stable/c/adec57ff8e66aee632f3dd1f93787c13d112b7a1 cve-icon cve-icon
https://git.kernel.org/stable/c/b36efd2e3e22a329444b6b24fa48df6d20ae66e6 cve-icon cve-icon
https://git.kernel.org/stable/c/b813e3fd102a959c5b208ed68afe27e0137a561b cve-icon cve-icon
https://git.kernel.org/stable/c/e65a0dc2e85efb28e182aca50218e8a056d0ce04 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024072946-CVE-2024-42090-5687@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-42090 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-42090 cve-icon
History

Wed, 11 Sep 2024 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 26 Aug 2024 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses CWE-667
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Thu, 22 Aug 2024 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-833
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-07-29T16:26:30.139Z

Updated: 2024-09-11T17:33:01.081Z

Reserved: 2024-07-29T15:50:41.172Z

Link: CVE-2024-42090

cve-icon Vulnrichment

Updated: 2024-09-11T12:42:14.076Z

cve-icon NVD

Status : Analyzed

Published: 2024-07-29T17:15:11.603

Modified: 2024-08-26T14:29:49.000

Link: CVE-2024-42090

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-07-29T00:00:00Z

Links: CVE-2024-42090 - Bugzilla