CVE-2024-56701

What it actually does

The dtl_access_lock was not a sleeping lock, so calling kmalloc() (which may sleep) while holding it triggers a sleeping-function-in-atomic-context bug on powerpc pseries systems.

Why it matters to the business

Systems running affected kernels on POWER hardware can experience crashes or instability when users or scripts write to /proc/powerpc/vcpudispatch_stats, disrupting operations; the issue has been public for over a year with negligible exploit activity and no ransomware use.

How an attack unfolds

An attacker or unprivileged user writes to /proc/powerpc/vcpudispatch_stats, which acquires dtl_enable_mutex then dtl_access_lock and calls alloc_dtl_buffers; kmalloc inside that path sleeps while the non-sleeping lock is held, crashing the kernel.

How to fix it

Upgrade the Linux kernel to commit 6956c0e7346ce1bbfc726755aa8da10d26e84276 or later stable releases; for the listed jasper packages apply the corresponding Ubuntu updates (1.900.1-14ubuntu3.4 or 1.900.1-debian1-2.4ubuntu1.1).

How to confirm the fix worked

Confirm the running kernel contains commit 6956c0e7346ce1bbfc726755aa8da10d26e84276; re-test by writing to /proc/powerpc/vcpudispatch_stats and verify no sleeping-function BUG occurs.

Typical attack path

1. Write data to /proc/powerpc/vcpudispatch_stats
2. Acquire dtl_enable_mutex and dtl_access_lock
3. Enter alloc_dtl_buffers and invoke kmalloc
4. Trigger sleep while lock is held, producing BUG

How to detect it

Search kernel logs for 'BUG: sleeping function called from invalid context' together with dtl_access_lock or alloc_dtl_buffers stack traces; review /proc/powerpc/vcpudispatch_stats write attempts around crash times.

• BUG: sleeping function called from invalid context at include/linux/sched/mm.h:337
• dtl_access_lock
• alloc_dtl_buffers
• vcpudispatch_stats_write

What your security team should do

• Apply the kernel fix immediately on all powerpc pseries systems
• Restrict write access to /proc/powerpc/vcpudispatch_stats until patched
• Monitor kernel logs for sleeping-function BUG messages