CVE-2024-57885

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-57885
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-57885.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-57885
Related
Published
2025-01-15T13:15:12Z
Modified
2025-01-16T05:49:47.620776Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

mm/kmemleak: fix sleeping function called from invalid context at print message

Address a bug in the kernel that triggers a "sleeping function called from invalid context" warning when /sys/kernel/debug/kmemleak is printed under specific conditions: - CONFIGPREEMPTRT=y - Set SELinux as the LSM for the system - Set kptr_restrict to 1 - kmemleak buffer contains at least one item

BUG: sleeping function called from invalid context at kernel/locking/spinlockrt.c:48 inatomic(): 1, irqsdisabled(): 1, nonblock: 0, pid: 136, name: cat preemptcount: 1, expected: 0 RCU nest depth: 2, expected: 2 6 locks held by cat/136: #0: ffff32e64bcbf950 (&p->lock){+.+.}-{3:3}, at: seqreaditer+0xb8/0xe30 #1: ffffafe6aaa9dea0 (scanmutex){+.+.}-{3:3}, at: kmemleakseqstart+0x34/0x128 #3: ffff32e6546b1cd0 (&object->lock){....}-{2:2}, at: kmemleakseqshow+0x3c/0x1e0 #4: ffffafe6aa8d8560 (rcureadlock){....}-{1:2}, at: hasnscapabilitynoaudit+0x8/0x1b0 #5: ffffafe6aabbc0f8 (notiflock){+.+.}-{2:2}, at: avccomputeav+0xc4/0x3d0 irq event stamp: 136660 hardirqs last enabled at (136659): [<ffffafe6a80fd7a0>] rawspinunlockirqrestore+0xa8/0xd8 hardirqs last disabled at (136660): [<ffffafe6a80fd85c>] rawspinlockirqsave+0x8c/0xb0 softirqs last enabled at (0): [<ffffafe6a5d50b28>] copyprocess+0x11d8/0x3df8 softirqs last disabled at (0): [<0000000000000000>] 0x0 Preemption disabled at: [<ffffafe6a6598a4c>] kmemleakseqshow+0x3c/0x1e0 CPU: 1 UID: 0 PID: 136 Comm: cat Tainted: G E 6.11.0-rt7+ #34 Tainted: [E]=UNSIGNEDMODULE Hardware name: linux,dummy-virt (DT) Call trace: dumpbacktrace+0xa0/0x128 showstack+0x1c/0x30 dumpstacklvl+0xe8/0x198 dumpstack+0x18/0x20 rtspinlock+0x8c/0x1a8 avcpermnonode+0xa0/0x150 credhascapability.isra.0+0x118/0x218 selinuxcapable+0x50/0x80 securitycapable+0x7c/0xd0 hasnscapabilitynoaudit+0x94/0x1b0 hascapabilitynoaudit+0x20/0x30 restrictedpointer+0x21c/0x4b0 pointer+0x298/0x760 vsnprintf+0x330/0xf70 seqprintf+0x178/0x218 printunreferenced+0x1a4/0x2d0 kmemleakseqshow+0xd0/0x1e0 seqreaditer+0x354/0xe30 seqread+0x250/0x378 fullproxyread+0xd8/0x148 vfsread+0x190/0x918 ksysread+0xf0/0x1e0 _arm64sysread+0x70/0xa8 invokesyscall.constprop.0+0xd4/0x1d8 el0svc+0x50/0x158 el0t64_sync+0x17c/0x180

%pS and %pK, in the same back trace line, are redundant, and %pS can void %pK service in certain contexts.

%pS alone already provides the necessary information, and if it cannot resolve the symbol, it falls back to printing the raw address voiding the original intent behind the %pK.

Additionally, %pK requires a privilege check CAPSYSLOG enforced through the LSM, which can trigger a "sleeping function called from invalid context" warning under RTPREEMPT kernels when the check occurs in an atomic context. This issue may also affect other LSMs.

This change avoids the unnecessary privilege check and resolves the sleeping function warning without any loss of information.

References

Affected packages

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.12.9-1

Affected versions

6.*

6.1.27-1
6.1.37-1
6.1.38-1
6.1.38-2~bpo11+1
6.1.38-2
6.1.38-3
6.1.38-4~bpo11+1
6.1.38-4
6.1.52-1
6.1.55-1~bpo11+1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.67-1
6.1.69-1~bpo11+1
6.1.69-1
6.1.76-1~bpo11+1
6.1.76-1
6.1.82-1
6.1.85-1
6.1.90-1~bpo11+1
6.1.90-1
6.1.94-1~bpo11+1
6.1.94-1
6.1.98-1
6.1.99-1
6.1.106-1
6.1.106-2
6.1.106-3
6.1.112-1
6.1.115-1
6.1.119-1
6.1.123-1
6.1.124-1
6.3.1-1~exp1
6.3.2-1~exp1
6.3.4-1~exp1
6.3.5-1~exp1
6.3.7-1~bpo12+1
6.3.7-1
6.3.11-1
6.4~rc6-1~exp1
6.4~rc7-1~exp1
6.4.1-1~exp1
6.4.4-1~bpo12+1
6.4.4-1
6.4.4-2
6.4.4-3~bpo12+1
6.4.4-3
6.4.11-1
6.4.13-1
6.5~rc4-1~exp1
6.5~rc6-1~exp1
6.5~rc7-1~exp1
6.5.1-1~exp1
6.5.3-1~bpo12+1
6.5.3-1
6.5.6-1
6.5.8-1
6.5.10-1~bpo12+1
6.5.10-1
6.5.13-1
6.6.3-1~exp1
6.6.4-1~exp1
6.6.7-1~exp1
6.6.8-1
6.6.9-1
6.6.11-1
6.6.13-1~bpo12+1
6.6.13-1
6.6.15-1
6.6.15-2
6.7-1~exp1
6.7.1-1~exp1
6.7.4-1~exp1
6.7.7-1
6.7.9-1
6.7.9-2
6.7.12-1~bpo12+1
6.7.12-1
6.8.9-1
6.8.11-1
6.8.12-1~bpo12+1
6.8.12-1
6.9.2-1~exp1
6.9.7-1~bpo12+1
6.9.7-1
6.9.8-1
6.9.9-1
6.9.10-1~bpo12+1
6.9.10-1
6.9.11-1
6.9.12-1
6.10-1~exp1
6.10.1-1~exp1
6.10.3-1
6.10.4-1
6.10.6-1~bpo12+1
6.10.6-1
6.10.7-1
6.10.9-1
6.10.11-1~bpo12+1
6.10.11-1
6.10.12-1
6.11~rc4-1~exp1
6.11~rc5-1~exp1
6.11-1~exp1
6.11.2-1
6.11.4-1
6.11.5-1~bpo12+1
6.11.5-1
6.11.6-1
6.11.7-1
6.11.9-1
6.11.10-1~bpo12+1
6.11.10-1
6.12~rc6-1~exp1
6.12.3-1
6.12.5-1
6.12.6-1
6.12.8-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}