🇰🇷 한글 설명
Linux 커널의 comedi 서브시스템에서 여러 low-level 드라이버로 재설정할 때 spinlock이 일관되지 않은 상태로 유지되어 발생하는 취약점입니다. COMEDI_DEVCONFIG ioctl을 통해 드라이버를 교체할 때 기존 spinlock 상태가 남아있어 문제가 발생합니다. CONFIG_LOCKDEP 활성화 시 드라이버 attach 전에 spinlock을 재초기화하여 해결합니다.
💡 쉬운 설명
Linux 커널의 comedi 드라이버 시스템에서 교체 시 이전 설정이 남아 간섭하는 문제입니다. 드라이버 교체 전에 설정을 초기화하면 문제가 해결됩니다.
🇺🇸 원문 (English)
In the Linux kernel, the following vulnerability has been resolved:
comedi: Reinit dev->spinlock between attachments to low-level drivers
`struct comedi_device` is the main controlling structure for a COMEDI
device created by the COMEDI subsystem. It contains a member `spinlock`
containing a spin-lock that is initialized by the COMEDI subsystem, but
is reserved for use by a low-level driver attached to the COMEDI device
(at least since commit 25436dc9d84f ("Staging: comedi: remove RT
code")).
Some COMEDI devices (those created on initialization of the COMEDI
subsystem when the "comedi.comedi_num_legacy_minors" parameter is
non-zero) can be attached to different low-level drivers over their
lifetime using the `COMEDI_DEVCONFIG` ioctl command. This can result in
inconsistent lock states being reported when there is a mismatch in the
spin-lock locking levels used by each low-level driver to which the
COMEDI device has been attached. Fix it by reinitializing
`dev->spinlock` before calling the low-level driver's `attach` function
pointer if `CONFIG_LOCKDEP` is enabled.
📍 영향받는 시스템
Linux kernel with comedi subsystem when CONFIG_LOCKDEP is enabled
⚔️ 공격 벡터
COMEDI_DEVCONFIG ioctl command used to switch between low-level drivers, causing spinlock state inconsistency
🛡️ 대응 방법
Update Linux kernel to patched version or apply spinlock reinitialization patch before low-level driver attachment
🔧 검증 코드
CONFIG_LOCKDEP=y이면 취약점 영향을 받으며, CONFIG_LOCKDEP=n이거나 not set이면 영향 없음
grep CONFIG_LOCKDEP /boot/config-$(uname -r) 2>/dev/null | grep -E 'CONFIG_LOCKDEP'