Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2024-53085: Linux kernel TPM suspend race may cause random failures
CVE-2024-53085 · published 1 year ago
Summary
The Linux kernel’s support for the TPM security chip could let a race condition occur when the system suspends, potentially leading to unexpected behavior when random data is requested. This issue has been fixed in recent kernel updates for mainstream Linux distributions. Apply the latest kernel patches from your Linux vendor to ensure the fix is in place.
What to do
- Update bellsoft linux-lts to version 6.12.41-r0.
- Update debian rootio-linux to version 6.1.174-1.root.io.153.
- Update debian rootio-linux to version 6.1.159-1.root.io.75.
- Update debian linux to version 6.11.9-1.
- Update linux kernel to version 6.11.8.
- Update canonical linux-aws-6.8 to version 6.8.0-1027.29~22.04.1.
- Update canonical linux-azure-6.8 to version 6.8.0-1027.32~22.04.1.
- Update canonical linux-gcp-6.8 to version 6.8.0-1028.30~22.04.1.
- Update canonical linux-hwe-6.8 to version 6.8.0-58.60~22.04.1.
- Update canonical linux-ibm-6.8 to version 6.8.0-1024.24~22.04.1.
- Update canonical linux-lowlatency-hwe-6.8 to version 6.8.0-58.60.1~22.04.1.
- Update canonical linux-nvidia-6.8 to version 6.8.0-1026.29~22.04.1.
- Update canonical linux-oracle-6.8 to version 6.8.0-1024.25~22.04.1.
- Update canonical linux-riscv-6.8 to version 6.8.0-58.60.1~22.04.1.
- Update canonical linux-realtime-6.8 to version 6.8.1-1020.21~22.04.1.
- Update canonical linux to version 6.8.0-58.60.
- Update canonical linux-aws to version 6.8.0-1027.29.
- Update canonical linux-azure to version 6.8.0-1027.32.
- Update canonical linux-azure-6.11 to version 6.11.0-1012.12~24.04.1.
- Update canonical linux-azure-nvidia to version 6.8.0-1014.15.
- Update canonical linux-gcp to version 6.8.0-1028.30.
- Update canonical linux-gcp-6.11 to version 6.11.0-1011.11~24.04.1.
- Update canonical linux-gke to version 6.8.0-1023.27.
- Update canonical linux-gkeop to version 6.8.0-1010.12.
- Update canonical linux-ibm to version 6.8.0-1024.24.
- Update canonical linux-lowlatency to version 6.8.0-58.60.1.
- Update canonical linux-nvidia to version 6.8.0-1026.29.
- Update canonical linux-nvidia-6.11 to version 6.11.0-1007.7.
- Update canonical linux-nvidia-lowlatency to version 6.8.0-1026.29.1.
- Update canonical linux-nvidia-tegra to version 6.8.0-1008.8.
- Update canonical linux-oem-6.11 to version 6.11.0-1015.15.
- Update canonical linux-oem-6.8 to version 6.8.0-1026.26.
- Update canonical linux-oracle to version 6.8.0-1024.25.
- Update canonical linux-raspi to version 6.8.0-1028.32.
- Update canonical linux-riscv to version 6.8.0-58.60.1.
- Update canonical linux-xilinx to version 6.8.0-1017.18.
- Update canonical linux-raspi-realtime to version 6.8.0-2023.24.
- Update canonical linux-realtime to version 6.8.1-1020.21.
- Update canonical linux-fips to version 6.8.0-78.78+fips1.
- Update linux to version 6.1.190-1.aikido.167.
- Update rootio-linux to version 6.1.190-1.aikido.167.
- Update linux linux_kernel to version 6.11.8 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
>= 6.4, < 6.11.8 6.12 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Alpaquita:23 | bellsoft | linux-lts | >= 6.1.170-r0 |
| Alpaquita:25 | bellsoft | linux-lts |
>= 6.6.89-r0, < 6.12.41-r0 Fix: upgrade to 6.12.41-r0
|
| Alpaquita:stream | bellsoft | linux-lts |
>= 6.6.100-r0, < 6.12.41-r0 Fix: upgrade to 6.12.41-r0
|
| Root:Debian:12 | debian | rootio-linux |
< 6.1.174-1.root.io.153 < 6.1.159-1.root.io.75 Fix: upgrade to 6.1.174-1.root.io.153
|
| Debian:12 | debian | linux | All versions |
| Debian:13 | debian | linux |
< 6.11.9-1 Fix: upgrade to 6.11.9-1
|
| Linux | linux | kernel |
>= 6.7.0, < 6.11.8 Fix: upgrade to 6.11.8
|
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gkeop-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oem | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-intel-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.10 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.14 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.6 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
Showing 50 of 121. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-allwinner-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.8 |
< 6.8.0-1027.29~22.04.1 Fix: upgrade to 6.8.0-1027.29~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-azure-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.8 |
< 6.8.0-1027.32~22.04.1 Fix: upgrade to 6.8.0-1027.32~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.8 |
< 6.8.0-1028.30~22.04.1 Fix: upgrade to 6.8.0-1028.30~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.8 |
< 6.8.0-58.60~22.04.1 Fix: upgrade to 6.8.0-58.60~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-ibm-6.8 |
< 6.8.0-1024.24~22.04.1 Fix: upgrade to 6.8.0-1024.24~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.8 |
< 6.8.0-58.60.1~22.04.1 Fix: upgrade to 6.8.0-58.60.1~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.8 |
< 6.8.0-1026.29~22.04.1 Fix: upgrade to 6.8.0-1026.29~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-oem-5.17 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.0 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.1 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.8 |
< 6.8.0-1024.25~22.04.1 Fix: upgrade to 6.8.0-1024.25~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.8 |
< 6.8.0-58.60.1~22.04.1 Fix: upgrade to 6.8.0-58.60.1~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-starfive-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.5 | All versions |
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-realtime-6.8 |
< 6.8.1-1020.21~22.04.1 Fix: upgrade to 6.8.1-1020.21~22.04.1
|
| Ubuntu:24.04:LTS | canonical | linux |
< 6.8.0-58.60 Fix: upgrade to 6.8.0-58.60
|
| Ubuntu:24.04:LTS | canonical | linux-aws |
< 6.8.0-1027.29 Fix: upgrade to 6.8.0-1027.29
|
| Ubuntu:24.04:LTS | canonical | linux-azure |
< 6.8.0-1027.32 Fix: upgrade to 6.8.0-1027.32
|
| Ubuntu:24.04:LTS | canonical | linux-azure-6.11 |
< 6.11.0-1012.12~24.04.1 Fix: upgrade to 6.11.0-1012.12~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-azure-nvidia |
< 6.8.0-1014.15 Fix: upgrade to 6.8.0-1014.15
|
| Ubuntu:24.04:LTS | canonical | linux-gcp |
< 6.8.0-1028.30 Fix: upgrade to 6.8.0-1028.30
|
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.11 |
< 6.11.0-1011.11~24.04.1 Fix: upgrade to 6.11.0-1011.11~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-gke |
< 6.8.0-1023.27 Fix: upgrade to 6.8.0-1023.27
|
| Ubuntu:24.04:LTS | canonical | linux-gkeop |
< 6.8.0-1010.12 Fix: upgrade to 6.8.0-1010.12
|
| Ubuntu:24.04:LTS | canonical | linux-ibm |
< 6.8.0-1024.24 Fix: upgrade to 6.8.0-1024.24
|
| Ubuntu:24.04:LTS | canonical | linux-lowlatency |
< 6.8.0-58.60.1 Fix: upgrade to 6.8.0-58.60.1
|
| Ubuntu:24.04:LTS | canonical | linux-nvidia |
< 6.8.0-1026.29 Fix: upgrade to 6.8.0-1026.29
|
| Ubuntu:24.04:LTS | canonical | linux-nvidia-6.11 |
< 6.11.0-1007.7 Fix: upgrade to 6.11.0-1007.7
|
| Ubuntu:24.04:LTS | canonical | linux-nvidia-lowlatency |
< 6.8.0-1026.29.1 Fix: upgrade to 6.8.0-1026.29.1
|
| Ubuntu:24.04:LTS | canonical | linux-nvidia-tegra |
< 6.8.0-1008.8 Fix: upgrade to 6.8.0-1008.8
|
| Ubuntu:24.04:LTS | canonical | linux-oem-6.11 |
< 6.11.0-1015.15 Fix: upgrade to 6.11.0-1015.15
|
| Ubuntu:24.04:LTS | canonical | linux-oem-6.8 |
< 6.8.0-1026.26 Fix: upgrade to 6.8.0-1026.26
|
| Ubuntu:24.04:LTS | canonical | linux-oracle |
< 6.8.0-1024.25 Fix: upgrade to 6.8.0-1024.25
|
| Ubuntu:24.04:LTS | canonical | linux-raspi |
< 6.8.0-1028.32 Fix: upgrade to 6.8.0-1028.32
|
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv |
< 6.8.0-58.60.1 Fix: upgrade to 6.8.0-58.60.1
|
| Ubuntu:24.04:LTS | canonical | linux-xilinx |
< 6.8.0-1017.18 Fix: upgrade to 6.8.0-1017.18
|
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-raspi-realtime |
< 6.8.0-2023.24 Fix: upgrade to 6.8.0-2023.24
|
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-realtime |
< 6.8.1-1020.21 Fix: upgrade to 6.8.1-1020.21
|
| Ubuntu:Pro:FIPS-updates:24.04:LTS | canonical | linux-fips |
< 6.8.0-78.78+fips1 Fix: upgrade to 6.8.0-78.78+fips1
|
| Root:Debian:12 | – | linux |
< 6.1.190-1.aikido.167 Fix: upgrade to 6.1.190-1.aikido.167
|
| Root:Debian:12 | – | rootio-linux |
< 6.1.190-1.aikido.167 Fix: upgrade to 6.1.190-1.aikido.167
|
Original advisory text
CVE-2024-53085 in linux - Patched by Root
In the Linux kernel, the following vulnerability has been resolved: tpm: Lock TPM chip in tpm_pm_suspend() first Setting TPM_CHIP_FLAG_SUSPENDED in the end of tpm_pm_suspend() can be racy according, as this leaves window for tpm_hwrng_read() to be called while the operation is in progress. The recent bug report gives also evidence of this behaviour. Aadress this by locking the TPM chip before checking any chip->flags both in tpm_pm_suspend() and tpm_hwrng_read(). Move TPM_CHIP_FLAG_SUSPENDED check inside tpm_get_random() so that it will be always checked only when the lock is reserved.
References
- https://git.kernel.org/stable/c/9265fed6db601ee2ec47577815387458ef4f047a URL
- https://git.kernel.org/stable/c/bc203fe416abdd1c29da594565a7c3c4e979488e URL
- https://git.kernel.org/stable/c/cfaf83501a0cbb104499c5b0892ee5ebde4e967f URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53085... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-53085 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://docs.bell-sw.com/security/cves/CVE-2024-53085 Vendor Advisory
- https://ubuntu.com/security/CVE-2024-53085 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-53085 Third Party Advisory
- https://git.kernel.org/linus/9265fed6db601ee2ec47577815387458ef4f047a Third Party Advisory
- https://ubuntu.com/security/notices/USN-7276-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7277-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7310-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7449-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7450-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7451-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7452-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7453-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7449-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7468-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7523-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7524-1 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2024-53085 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-667Improper Locking
Timeline
Published19 Nov 2024
Updated2 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-53085 · NVD
CVE-2024-53085 · OSV
BELL-CVE-2024-53085 · OSV
DEBIAN-CVE-2024-53085 · OSV
UBUNTU-CVE-2024-53085 · OSV
Track software like this
Free during beta