CVE-2024-49856

x86/sgx: Fix deadlock in SGX NUMA node search

State: Published
Severity: Not scored
Published: Oct 21, 2024
Updated: May 11, 2026
Reserved: Oct 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

x86/sgx: Fix deadlock in SGX NUMA node search

When the current node doesn't have an EPC section configured by firmware and all other EPC sections are used up, CPU can get stuck inside the while loop that looks for an available EPC page from remote nodes indefinitely, leading to a soft lockup. Note how nid_of_current will never be equal to nid in that while loop because nid_of_current is not set in sgx_numa_mask.

Also worth mentioning is that it's perfectly fine for the firmware not to setup an EPC section on a node. While setting up an EPC section on each node can enhance performance, it is not a requirement for functionality.

Rework the loop to start and end on *a* node that has SGX memory. This avoids the deadlock looking for the current SGX-lacking node to show up in the loop when it never will.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	901ddbb9ecf5425183ea0c09d10c2fd7868dce54 to before 40fb64257dab507d86b5f1f2a62f3669ef0c91a8Affected 901ddbb9ecf5425183ea0c09d10c2fd7868dce54 to before 20c96d0aaabfe361fc2a11c173968dc67feadbbfAffected 901ddbb9ecf5425183ea0c09d10c2fd7868dce54 to before fb2d057539eda67ec7cfc369bf587e6518a9b99dAffected 901ddbb9ecf5425183ea0c09d10c2fd7868dce54 to before 0f89fb4042c08fd143bfc28af08bf6c8a0197eeaAffected 901ddbb9ecf5425183ea0c09d10c2fd7868dce54 to before 8132510c915815e6b537ab937d94ed66893bc7b8Affected 901ddbb9ecf5425183ea0c09d10c2fd7868dce54 to before 9c936844010466535bd46ea4ce4656ef17653644Affected
LinuxLinux	5.13Affected before 5.13Not affected 5.15.168 through 5.15.Not affected 6.1.113 through 6.1.Not affected 6.6.54 through 6.6.Not affected 6.10.13 through 6.10.Not affected 6.11.2 through 6.11.*Not affected 6.12 and laterNot affected

Product

Versions

LinuxLinux

901ddbb9ecf5425183ea0c09d10c2fd7868dce54 to before 40fb64257dab507d86b5f1f2a62f3669ef0c91a8Affected
901ddbb9ecf5425183ea0c09d10c2fd7868dce54 to before 20c96d0aaabfe361fc2a11c173968dc67feadbbfAffected
901ddbb9ecf5425183ea0c09d10c2fd7868dce54 to before fb2d057539eda67ec7cfc369bf587e6518a9b99dAffected
901ddbb9ecf5425183ea0c09d10c2fd7868dce54 to before 0f89fb4042c08fd143bfc28af08bf6c8a0197eeaAffected
901ddbb9ecf5425183ea0c09d10c2fd7868dce54 to before 8132510c915815e6b537ab937d94ed66893bc7b8Affected
901ddbb9ecf5425183ea0c09d10c2fd7868dce54 to before 9c936844010466535bd46ea4ce4656ef17653644Affected

LinuxLinux

5.13Affected
before 5.13Not affected
5.15.168 through 5.15.*Not affected
6.1.113 through 6.1.*Not affected
6.6.54 through 6.6.*Not affected
6.10.13 through 6.10.*Not affected
6.11.2 through 6.11.*Not affected
6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.