CVE-2024-49856 (GCVE-0-2024-49856)

Vulnerability from cvelistv5 – Published: 2024-10-21 12:18 – Updated: 2025-11-03 22:22
VLAI?
Title
x86/sgx: Fix deadlock in SGX NUMA node search
Summary
In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Fix deadlock in SGX NUMA node search When the current node doesn't have an EPC section configured by firmware and all other EPC sections are used up, CPU can get stuck inside the while loop that looks for an available EPC page from remote nodes indefinitely, leading to a soft lockup. Note how nid_of_current will never be equal to nid in that while loop because nid_of_current is not set in sgx_numa_mask. Also worth mentioning is that it's perfectly fine for the firmware not to setup an EPC section on a node. While setting up an EPC section on each node can enhance performance, it is not a requirement for functionality. Rework the loop to start and end on *a* node that has SGX memory. This avoids the deadlock looking for the current SGX-lacking node to show up in the loop when it never will.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 901ddbb9ecf5425183ea0c09d10c2fd7868dce54 , < 40fb64257dab507d86b5f1f2a62f3669ef0c91a8 (git)
Affected: 901ddbb9ecf5425183ea0c09d10c2fd7868dce54 , < 20c96d0aaabfe361fc2a11c173968dc67feadbbf (git)
Affected: 901ddbb9ecf5425183ea0c09d10c2fd7868dce54 , < fb2d057539eda67ec7cfc369bf587e6518a9b99d (git)
Affected: 901ddbb9ecf5425183ea0c09d10c2fd7868dce54 , < 0f89fb4042c08fd143bfc28af08bf6c8a0197eea (git)
Affected: 901ddbb9ecf5425183ea0c09d10c2fd7868dce54 , < 8132510c915815e6b537ab937d94ed66893bc7b8 (git)
Affected: 901ddbb9ecf5425183ea0c09d10c2fd7868dce54 , < 9c936844010466535bd46ea4ce4656ef17653644 (git)
Create a notification for this product.
    Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.54 , ≤ 6.6.* (semver)
Unaffected: 6.10.13 , ≤ 6.10.* (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49856",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T12:56:17.015207Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:11.066Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:22:25.584Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/cpu/sgx/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "40fb64257dab507d86b5f1f2a62f3669ef0c91a8",
              "status": "affected",
              "version": "901ddbb9ecf5425183ea0c09d10c2fd7868dce54",
              "versionType": "git"
            },
            {
              "lessThan": "20c96d0aaabfe361fc2a11c173968dc67feadbbf",
              "status": "affected",
              "version": "901ddbb9ecf5425183ea0c09d10c2fd7868dce54",
              "versionType": "git"
            },
            {
              "lessThan": "fb2d057539eda67ec7cfc369bf587e6518a9b99d",
              "status": "affected",
              "version": "901ddbb9ecf5425183ea0c09d10c2fd7868dce54",
              "versionType": "git"
            },
            {
              "lessThan": "0f89fb4042c08fd143bfc28af08bf6c8a0197eea",
              "status": "affected",
              "version": "901ddbb9ecf5425183ea0c09d10c2fd7868dce54",
              "versionType": "git"
            },
            {
              "lessThan": "8132510c915815e6b537ab937d94ed66893bc7b8",
              "status": "affected",
              "version": "901ddbb9ecf5425183ea0c09d10c2fd7868dce54",
              "versionType": "git"
            },
            {
              "lessThan": "9c936844010466535bd46ea4ce4656ef17653644",
              "status": "affected",
              "version": "901ddbb9ecf5425183ea0c09d10c2fd7868dce54",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/cpu/sgx/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/sgx: Fix deadlock in SGX NUMA node search\n\nWhen the current node doesn\u0027t have an EPC section configured by firmware\nand all other EPC sections are used up, CPU can get stuck inside the\nwhile loop that looks for an available EPC page from remote nodes\nindefinitely, leading to a soft lockup. Note how nid_of_current will\nnever be equal to nid in that while loop because nid_of_current is not\nset in sgx_numa_mask.\n\nAlso worth mentioning is that it\u0027s perfectly fine for the firmware not\nto setup an EPC section on a node. While setting up an EPC section on\neach node can enhance performance, it is not a requirement for\nfunctionality.\n\nRework the loop to start and end on *a* node that has SGX memory. This\navoids the deadlock looking for the current SGX-lacking node to show up\nin the loop when it never will."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T09:39:38.876Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/40fb64257dab507d86b5f1f2a62f3669ef0c91a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/20c96d0aaabfe361fc2a11c173968dc67feadbbf"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb2d057539eda67ec7cfc369bf587e6518a9b99d"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f89fb4042c08fd143bfc28af08bf6c8a0197eea"
        },
        {
          "url": "https://git.kernel.org/stable/c/8132510c915815e6b537ab937d94ed66893bc7b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c936844010466535bd46ea4ce4656ef17653644"
        }
      ],
      "title": "x86/sgx: Fix deadlock in SGX NUMA node search",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49856",
    "datePublished": "2024-10-21T12:18:48.123Z",
    "dateReserved": "2024-10-21T12:17:06.016Z",
    "dateUpdated": "2025-11-03T22:22:25.584Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:22:25.584Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49856\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T12:56:17.015207Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T12:56:20.359Z\"}}], \"cna\": {\"title\": \"x86/sgx: Fix deadlock in SGX NUMA node search\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"901ddbb9ecf5425183ea0c09d10c2fd7868dce54\", \"lessThan\": \"40fb64257dab507d86b5f1f2a62f3669ef0c91a8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"901ddbb9ecf5425183ea0c09d10c2fd7868dce54\", \"lessThan\": \"20c96d0aaabfe361fc2a11c173968dc67feadbbf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"901ddbb9ecf5425183ea0c09d10c2fd7868dce54\", \"lessThan\": \"fb2d057539eda67ec7cfc369bf587e6518a9b99d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"901ddbb9ecf5425183ea0c09d10c2fd7868dce54\", \"lessThan\": \"0f89fb4042c08fd143bfc28af08bf6c8a0197eea\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"901ddbb9ecf5425183ea0c09d10c2fd7868dce54\", \"lessThan\": \"8132510c915815e6b537ab937d94ed66893bc7b8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"901ddbb9ecf5425183ea0c09d10c2fd7868dce54\", \"lessThan\": \"9c936844010466535bd46ea4ce4656ef17653644\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/x86/kernel/cpu/sgx/main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/x86/kernel/cpu/sgx/main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/40fb64257dab507d86b5f1f2a62f3669ef0c91a8\"}, {\"url\": \"https://git.kernel.org/stable/c/20c96d0aaabfe361fc2a11c173968dc67feadbbf\"}, {\"url\": \"https://git.kernel.org/stable/c/fb2d057539eda67ec7cfc369bf587e6518a9b99d\"}, {\"url\": \"https://git.kernel.org/stable/c/0f89fb4042c08fd143bfc28af08bf6c8a0197eea\"}, {\"url\": \"https://git.kernel.org/stable/c/8132510c915815e6b537ab937d94ed66893bc7b8\"}, {\"url\": \"https://git.kernel.org/stable/c/9c936844010466535bd46ea4ce4656ef17653644\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/sgx: Fix deadlock in SGX NUMA node search\\n\\nWhen the current node doesn\u0027t have an EPC section configured by firmware\\nand all other EPC sections are used up, CPU can get stuck inside the\\nwhile loop that looks for an available EPC page from remote nodes\\nindefinitely, leading to a soft lockup. Note how nid_of_current will\\nnever be equal to nid in that while loop because nid_of_current is not\\nset in sgx_numa_mask.\\n\\nAlso worth mentioning is that it\u0027s perfectly fine for the firmware not\\nto setup an EPC section on a node. While setting up an EPC section on\\neach node can enhance performance, it is not a requirement for\\nfunctionality.\\n\\nRework the loop to start and end on *a* node that has SGX memory. This\\navoids the deadlock looking for the current SGX-lacking node to show up\\nin the loop when it never will.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.54\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"5.13\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:39:38.876Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49856\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T22:22:25.584Z\", \"dateReserved\": \"2024-10-21T12:17:06.016Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T12:18:48.123Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.