CVE-2024-35929: linux-libc-dev - Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock()
Summary
CVE-2024-35929: In the Linux kernel, the following vulnerability has been resolved: rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock() For the kernels built with CONFIG_RCU_NOCB_CPU_DEFAULT_ALL=y and CONFIG_RCU_LAZY=y, the follo... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package that provides the C library headers for the Linux kernel. It is an essential component for compiling and building software on Linux systems. This package contains the necessary header files and static libraries for developing applications that directly interact with the kernel. The linux-libc-dev package is vulnerable to a specific issue related to the RCU (Read-Copy-Update) subsystem.
Vulnerability Detail
The vulnerability (CVE-2024-35929) in linux-libc-dev is related to the RCU_NOCB (No Callback) feature, which is enabled when the kernel is built with CONFIG_RCU_NOCB_CPU_DEFAULT_ALL=y and CONFIG_RCU_LAZY=y. In certain scenarios, when the RCU_NOCB feature is active, a race condition can occur between two kernel threads, leading to a WARN_ON_ONCE() trigger in the rcu_nocb_bypass_lock() and rcu_nocb_wait_contended() functions. This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by following general security best practices, such as ensuring the system is up to date with the latest security patches, using a firewall to restrict network access, and implementing proper access controls to limit the impact of potential attacks.
Conclusion
The linux-libc-dev package is vulnerable to a race condition in the RCU_NOCB subsystem, which can lead to a denial-of-service or potential code execution. It is crucial to update the package to a fixed version and regularly apply security patches to protect the system. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package that provides the C library headers for the Linux kernel. It is used for compiling and building software that interacts with the kernel.
RCU (Read-Copy-Update) is a synchronization mechanism used in the Linux kernel to allow efficient read-side access to shared data structures without locking.
RCU_NOCB (No Callback) is a feature that optimizes RCU by avoiding certain callbacks. It is enabled when specific kernel configuration options are set.
This vulnerability can lead to a denial-of-service (DoS) condition or potentially allow an attacker to execute arbitrary code on a vulnerable system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and it will provide real-time alerts for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
