CVE-2024-47658

What it actually does

Failure to disable bottom halves (BH) during the finalize operation in interrupt mode for the STM32 CRYP driver causes spinlock recursion warnings due to improper locking context in the Linux kernel crypto subsystem.

Why it matters to the business

Organizations running affected Linux kernel versions on STM32-based hardware may encounter kernel warnings, reduced stability during cryptographic operations, or potential denial-of-service conditions in high-throughput encryption workloads; the presence of downstream dependents increases exposure across embedded and server environments.

How an attack unfolds

An attacker triggers concurrent finalize calls in interrupt context on the STM32 crypto driver, exploiting the race condition to induce spinlock recursion; threat actors in 2024 zero-day campaigns and those targeting Linux kernel resource issues could chain this with other primitives for system instability or information leaks.

How to fix it

Update the Linux kernel to commit d93a2f86b0a998aa1f0870c85a2a60a0771ef89a or later stable releases; for github.com/hashicorp/vault update to version 1.3.4 or newer if the component is in use.

How to confirm the fix worked

Verify the running kernel contains commit d93a2f86b0a998aa1f0870c85a2a60a0771ef89a via uname or source inspection; confirm absence of spinlock recursion warnings during interrupt-mode crypto finalize operations under load.

Typical attack path

1. Identify systems using STM32 CRYP hardware with vulnerable kernel versions
2. Trigger cryptographic operations that invoke finalize in interrupt mode
3. Induce timing or concurrency conditions to hit the BH-disabled path
4. Observe or leverage resulting spinlock recursion for denial of service or further exploitation

How to detect it

Review kernel logs for spinlock recursion warnings originating from stm32-cryp finalize paths; correlate with crypto interrupt activity and check for presence of threat actor TTPs associated with Linux kernel resource or out-of-bounds issues.

What your security team should do

• Prioritize kernel upgrades on all STM32-based systems within the next patching cycle due to potential stability impact
• Monitor EPSS trend and re-evaluate if exploitation maturity increases
• Audit crypto usage in interrupt contexts and test for warnings post-upgrade
• Apply fixes to downstream dependents listed in ecosystem prevalence data