CVE-2024-49856

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-49856

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: x86/sgx: Fix deadlock in SGX NUMA node search When the current node doesn't have an EPC section configured by firmware and all other EPC sections are used up, CPU can get stuck inside the while loop that looks for an available EPC page from remote nodes indefinitely, leading to a soft lockup. Note how nid_of_current will never be equal to nid in that while loop because nid_of_current is not set in sgx_numa_mask. Also worth mentioning is that it's perfectly fine for the firmware not to setup an EPC section on a node. While setting up an EPC section on each node can enhance performance, it is not a requirement for functionality. Rework the loop to start and end on *a* node that has SGX memory. This avoids the deadlock looking for the current SGX-lacking node to show up in the loop when it never will.

References
Link Resource
https://git.kernel.org/stable/c/0f89fb4042c08fd143bfc28af08bf6c8a0197eea Patch
https://git.kernel.org/stable/c/20c96d0aaabfe361fc2a11c173968dc67feadbbf Patch
https://git.kernel.org/stable/c/40fb64257dab507d86b5f1f2a62f3669ef0c91a8 Patch
https://git.kernel.org/stable/c/8132510c915815e6b537ab937d94ed66893bc7b8 Patch
https://git.kernel.org/stable/c/9c936844010466535bd46ea4ce4656ef17653644 Patch
https://git.kernel.org/stable/c/fb2d057539eda67ec7cfc369bf587e6518a9b99d Patch
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

03 Nov 2025, 23:16

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html -

23 Oct 2024, 16:33

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/0f89fb4042c08fd143bfc28af08bf6c8a0197eea - () https://git.kernel.org/stable/c/0f89fb4042c08fd143bfc28af08bf6c8a0197eea - Patch
References () https://git.kernel.org/stable/c/20c96d0aaabfe361fc2a11c173968dc67feadbbf - () https://git.kernel.org/stable/c/20c96d0aaabfe361fc2a11c173968dc67feadbbf - Patch
References () https://git.kernel.org/stable/c/40fb64257dab507d86b5f1f2a62f3669ef0c91a8 - () https://git.kernel.org/stable/c/40fb64257dab507d86b5f1f2a62f3669ef0c91a8 - Patch
References () https://git.kernel.org/stable/c/8132510c915815e6b537ab937d94ed66893bc7b8 - () https://git.kernel.org/stable/c/8132510c915815e6b537ab937d94ed66893bc7b8 - Patch
References () https://git.kernel.org/stable/c/9c936844010466535bd46ea4ce4656ef17653644 - () https://git.kernel.org/stable/c/9c936844010466535bd46ea4ce4656ef17653644 - Patch
References () https://git.kernel.org/stable/c/fb2d057539eda67ec7cfc369bf587e6518a9b99d - () https://git.kernel.org/stable/c/fb2d057539eda67ec7cfc369bf587e6518a9b99d - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/sgx: Se solucionó el bloqueo en la búsqueda de nodos NUMA de SGX Cuando el nodo actual no tiene una sección EPC configurada por el firmware y todas las demás secciones EPC están agotadas, la CPU puede quedar atrapada dentro del bucle while que busca una página EPC disponible de los nodos remotos de forma indefinida, lo que lleva a un bloqueo suave. Tenga en cuenta que nid_of_current nunca será igual a nid en ese bucle while porque nid_of_current no está configurado en sgx_numa_mask. También vale la pena mencionar que está perfectamente bien que el firmware no configure una sección EPC en un nodo. Si bien configurar una sección EPC en cada nodo puede mejorar el rendimiento, no es un requisito para la funcionalidad. Rehaga el bucle para que comience y termine en *un* nodo que tenga memoria SGX. Esto evita el bloqueo que busca el nodo actual que carece de SGX para que aparezca en el bucle cuando nunca lo hará.
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-835

21 Oct 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-21 13:15

Updated : 2025-11-03 23:16

NVD link : CVE-2024-49856

Mitre link : CVE-2024-49856

CVE.ORG link : CVE-2024-49856

JSON object : View

Products Affected

linux

CWE
CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')