CVE-2024-49963
NoneCVSS
—
EPSS
0.3%
Published
Oct 21, 2024
CISA due date
—
Cloudanix analysis
A power-saving bug on certain Raspberry Pi computers could cause the system to get stuck or take too long when trying to sleep, and updating the operating system fixes it.
- Exploitation
- Other
- Attacker needs
- None
- Complexity
- Theoretical
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Misconfiguration
- Remediation
- Patch
- Effort
- Low
- Patch risk
- Low
What it actually does
The BCM2835 mailbox IRQ is disabled during the noirq suspend phase, causing rpi_firmware_property_list calls to always time out because the VideoCore is not treated as a wakeup source.
Why it matters to the business
Raspberry Pi systems experience prolonged or failed suspend operations, increasing power consumption and risking incomplete low-power state transitions in embedded deployments.
How an attack unfolds
An attacker with local access triggers a suspend cycle; the disabled mailbox IRQ prevents firmware property transactions from completing, leading to warnings and delayed or aborted suspend on affected kernels.
How to fix it
Update to Linux kernel commit 4e1e03760ee7cc4779b6306867fe0fc02921b963 or later; rebuild and deploy the kernel with IRQF_NO_SUSPEND set on the bcm2835 mailbox IRQ handler.
How to confirm the fix worked
Confirm the patch is present by checking for IRQF_NO_SUSPEND in the mailbox probe path; test suspend-resume cycles and verify absence of rpi_firmware_property_list timeout warnings.
Typical attack path
- Obtain local shell or code execution on a Raspberry Pi running an affected kernel
- Initiate system suspend via power management interfaces
- Observe noirq phase where mailbox IRQ is masked
- Trigger firmware property calls that block indefinitely
How to detect it
Search kernel logs for 'Firmware transaction' timeout messages during suspend and stack traces referencing rpi_firmware_property_list in the noirq suspend path.
What your security team should do
- Prioritize kernel upgrade on all Raspberry Pi fleets within the next maintenance window
- Monitor EPSS and KEV status for any future elevation in exploit activity
- Add suspend/resume regression tests that exercise firmware property paths
The record
In the Linux kernel, the following vulnerability has been resolved: mailbox: bcm2835: Fix timeout during suspend mode During noirq suspend phase the Raspberry Pi power driver suffer of firmware property timeouts. The reason is that the IRQ of the underlying BCM2835 mailbox is disabled and rpi_firmware_property_list() will always run into a timeout [1]. Since the VideoCore side isn't consider as a wakeup source, set the IRQF_NO_SUSPEND flag for the mailbox IRQ in order to keep it enabled during suspend-resume cycle. [1] PM: late suspend of devices complete after 1.754 msecs WARNING: CPU: 0 PID: 438 at drivers/firmware/raspberrypi.c:128 rpi_firmware_property_list+0x204/0x22c Firmware transaction 0x00028001 timeout Modules linked in: CPU: 0 PID: 438 Comm: bash Tainted: G C 6.9.3-dirty #17 Hardware name: BCM2835 Call trace: unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x34/0x44 dump_stack_lvl from __warn+0x88/0xec __warn from warn_slowpath_fmt+0x7c/0xb0 warn_slowpath_fmt from rpi_firmware_property_list+0x204/0x22c rpi_firmware_property_list from rpi_firmware_property+0x68/0x8c rpi_firmware_property from rpi_firmware_set_power+0x54/0xc0 rpi_firmware_set_power from _genpd_power_off+0xe4/0x148 _genpd_power_off from genpd_sync_power_off+0x7c/0x11c genpd_sync_power_off from genpd_finish_suspend+0xcc/0xe0 genpd_finish_suspend from dpm_run_callback+0x78/0xd0 dpm_run_callback from device_suspend_noirq+0xc0/0x238 device_suspend_noirq from dpm_suspend_noirq+0xb0/0x168 dpm_suspend_noirq from suspend_devices_and_enter+0x1b8/0x5ac suspend_devices_and_enter from pm_suspend+0x254/0x2e4 pm_suspend from state_store+0xa8/0xd4 state_store from kernfs_fop_write_iter+0x154/0x1a0 kernfs_fop_write_iter from vfs_write+0x12c/0x184 vfs_write from ksys_write+0x78/0xc0 ksys_write from ret_fast_syscall+0x0/0x54 Exception stack(0xcc93dfa8 to 0xcc93dff0) [...] PM: noirq suspend of devices complete after 3095.584 msecs
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux | 0 | No fix |
| Debian:11 | linux | 0 | 5.10.234-1 |
| Debian:11 | linux-6.1 | 0 | 6.1.119-1~deb11u1 |
| Debian:12 | linux | 0 | No fix |
| Debian:13 | linux | 0 | No fix |
| Debian:13 | linux | 0 | 6.11.4-1 |
| Linux | Kernel | 4.2.0 | 4.19.323 |
| Mageia:9 | kernel | 0 | 6.6.58-2.mga9 |
| Mageia:9 | kernel-firmware | 0 | 20240909-1.mga9 |
| Mageia:9 | kernel-firmware-nonfree | 0 | 20240909-1.mga9.nonfree |
| Mageia:9 | kernel-linus | 0 | 6.6.58-2.mga9 |
| Mageia:9 | kmod-virtualbox | 0 | 7.0.20-57.mga9 |
| Mageia:9 | kmod-xtables-addons | 0 | 3.24-65.mga9 |
| Mageia:9 | radeon-firmware | 0 | 20240909-1.mga9.nonfree |
| SUSE:Linux Enterprise High Availability Extension 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Live Patching 12 SP5 | kernel-default | 0 | 4.12.14-122.250.1 |
| SUSE:Linux Enterprise Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_66 | 0 | 1-8.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5-RT_Update_23 | 0 | 1-150500.11.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_21 | 0 | 1-150500.11.5.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_5 | 0 | 1-150600.1.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_6 | 0 | 1-150600.13.3.5 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-default | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-default-base | 0 | 5.14.21-150500.55.88.1.150500.6.39.4 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-rt | 0 | 5.14.21-150500.13.79.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-source-rt | 0 | 5.14.21-150500.13.79.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-64kb | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-default-base | 0 | 5.14.21-150500.55.88.1.150500.6.39.4 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-source | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | kernel-zfcpdump | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.30.1.150600.12.12.6 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco | 0 | 6.4.0-15061.9.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco_debug | 0 | 6.4.0-15061.9.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-source-coco | 0 | 6.4.0-15061.9.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-syms-coco | 0 | 6.4.0-15061.9.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP5 | kernel-docs | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP5 | kernel-obs-build | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP5 | kernel-source | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP5 | kernel-syms | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.88.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | kernel-azure | 0 | 5.14.21-150500.33.75.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | kernel-source-azure | 0 | 5.14.21-150500.33.75.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | kernel-syms-azure | 0 | 5.14.21-150500.33.75.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.17.2 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.17.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.17.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | kernel-default | 0 | 4.12.14-122.250.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | kernel-source | 0 | 4.12.14-122.250.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | kernel-syms | 0 | 4.12.14-122.250.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | kernel-default | 0 | 4.12.14-122.250.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | kernel-source | 0 | 4.12.14-122.250.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | kernel-syms | 0 | 4.12.14-122.250.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Real Time Module 15 SP5 | kernel-rt | 0 | 5.14.21-150500.13.79.1 |
| SUSE:Real Time Module 15 SP5 | kernel-rt_debug | 0 | 5.14.21-150500.13.79.1 |
| SUSE:Real Time Module 15 SP5 | kernel-source-rt | 0 | 5.14.21-150500.13.79.1 |
| SUSE:Real Time Module 15 SP5 | kernel-syms-rt | 0 | 5.14.21-150500.13.79.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.17.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.17.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.17.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.17.1 |
| Ubuntu:20.04:LTS | linux-aws-5.15 | 0 | 5.15.0-1073.79~20.04.1 |
| Ubuntu:20.04:LTS | linux-azure-5.15 | 0 | 5.15.0-1078.87~20.04.1 |
| Ubuntu:20.04:LTS | linux-gcp-5.15 | 0 | 5.15.0-1072.80~20.04.1 |
| Ubuntu:20.04:LTS | linux-hwe-5.15 | 0 | 5.15.0-127.137~20.04.1 |
| Ubuntu:20.04:LTS | linux-ibm-5.15 | 0 | 5.15.0-1066.69~20.04.1 |
| Ubuntu:20.04:LTS | linux-intel-iotg-5.15 | 0 | 5.15.0-1071.77~20.04.1 |
| Ubuntu:20.04:LTS | linux-lowlatency-hwe-5.15 | 0 | 5.15.0-127.137~20.04.1 |
| Ubuntu:20.04:LTS | linux-oracle-5.15 | 0 | 5.15.0-1071.77~20.04.1 |
| Ubuntu:22.04:LTS | linux | 0 | 5.15.0-127.137 |
| Ubuntu:22.04:LTS | linux-aws | 0 | 5.15.0-1073.79 |
| Ubuntu:22.04:LTS | linux-azure | 0 | 5.15.0-1078.87 |
| Ubuntu:22.04:LTS | linux-gcp | 0 | 5.15.0-1072.80 |
| Ubuntu:22.04:LTS | linux-gke | 0 | 5.15.0-1070.76 |
| Ubuntu:22.04:LTS | linux-gkeop | 0 | 5.15.0-1056.63 |
| Ubuntu:22.04:LTS | linux-ibm | 0 | 5.15.0-1066.69 |
| Ubuntu:22.04:LTS | linux-intel-iotg | 0 | 5.15.0-1071.77 |
| Ubuntu:22.04:LTS | linux-kvm | 0 | 5.15.0-1070.75 |
| Ubuntu:22.04:LTS | linux-lowlatency | 0 | 5.15.0-127.137 |
| Ubuntu:22.04:LTS | linux-nvidia | 0 | 5.15.0-1068.69 |
| Ubuntu:22.04:LTS | linux-oracle | 0 | 5.15.0-1071.77 |
| Ubuntu:22.04:LTS | linux-raspi | 0 | 5.15.0-1066.69 |
| Ubuntu:22.04:LTS | linux-xilinx-zynqmp | 0 | 5.15.0-1039.43 |
| Ubuntu:24.10 | linux | 0 | 6.11.0-18.18 |
| Ubuntu:24.10 | linux-aws | 0 | 6.11.0-1009.10 |
| Ubuntu:24.10 | linux-azure | 0 | 6.11.0-1009.9 |
| Ubuntu:24.10 | linux-gcp | 0 | 6.11.0-1009.9 |
| Ubuntu:24.10 | linux-lowlatency | 0 | 6.11.0-1010.11 |
| Ubuntu:24.10 | linux-oracle | 0 | 6.11.0-1011.12 |
| Ubuntu:24.10 | linux-raspi | 0 | 6.11.0-1008.8 |
| Ubuntu:24.10 | linux-realtime | 0 | 6.11.0-1005.5 |
| openSUSE:Leap 15.5 | kernel-azure | 0 | 5.14.21-150500.33.75.1 |
| openSUSE:Leap 15.5 | kernel-rt | 0 | 5.14.21-150500.13.79.1 |
| openSUSE:Leap 15.5 | kernel-rt_debug | 0 | 5.14.21-150500.13.79.1 |
| openSUSE:Leap 15.5 | kernel-source-azure | 0 | 5.14.21-150500.33.75.1 |
| openSUSE:Leap 15.5 | kernel-source-rt | 0 | 5.14.21-150500.13.79.1 |
| openSUSE:Leap 15.5 | kernel-syms-azure | 0 | 5.14.21-150500.33.75.1 |
| openSUSE:Leap 15.5 | kernel-syms-rt | 0 | 5.14.21-150500.13.79.1 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-azure | 0 | 6.4.0-150600.8.17.2 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.30.1.150600.12.12.6 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-rt | 0 | 6.4.0-150600.10.17.1 |
| openSUSE:Leap 15.6 | kernel-rt_debug | 0 | 6.4.0-150600.10.17.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-source-azure | 0 | 6.4.0-150600.8.17.1 |
| openSUSE:Leap 15.6 | kernel-source-rt | 0 | 6.4.0-150600.10.17.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-syms-azure | 0 | 6.4.0-150600.8.17.1 |
| openSUSE:Leap 15.6 | kernel-syms-rt | 0 | 6.4.0-150600.10.17.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap Micro 5.5 | kernel-rt | 0 | 5.14.21-150500.13.79.1 |
| openSUSE:Tumbleweed | kernel-source | 0 | 6.11.8-1.1 |
| openSUSE:Tumbleweed | kernel-source-longterm | 0 | 6.12.11-1.1 |
Related vulnerabilities
- CVE-2025-39885 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive… Also affects linux
- CVE-2025-39883 In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure… Also affects linux
- CVE-2025-39876 In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix… Also affects linux
- CVE-2025-39869 In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma… Also affects linux
- CVE-2025-39873 In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can… Also affects linux
- CVE-2025-39863 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix… Also affects linux
- CVE-2025-39865 In the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer… Also affects linux
- CVE-2025-39866 In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix… Also affects linux