Critical Vulnerability in Linux Kernel: IPsec Lock Change Leading to Scheduling Issues
Summary
CVE-2024-46678: In the Linux kernel, the following vulnerability has been resolved: bonding: change ipsec_lock from spin lock to mutex In the cited commit, bond->ipsec_lock is added to protect ipsec_list, hence xdo_dev_state_add and xdo... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management, process control, and system security. It is widely used in various distributions, including Debian. The kernel's bonding feature allows the aggregation of multiple network interfaces to increase throughput and provide redundancy. However, a recent vulnerability has been identified that affects the locking mechanism used in the IPsec implementation within the bonding module, potentially leading to system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability was discovered related to the bonding module's IPsec locking mechanism. The ipsec_lock was originally implemented as a spin lock, which does not allow sleeping. This design choice led to a situation where certain operations, specifically xfrmdev operations that may sleep, were called while holding the spin lock. This resulted in a 'scheduling while atomic' bug, which can cause system crashes or instability when changing the active slave in a bonded interface. The issue arises from the incorrect use of locking mechanisms that do not accommodate the possibility of sleeping operations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid changing the active slave in bonded interfaces until they can apply the fix. This will prevent triggering the scheduling issue while waiting for an official patch.
Conclusion
The vulnerability identified in the Linux kernel's bonding module poses significant risks to system stability due to improper locking mechanisms. By upgrading to the latest patched version of the kernel, users can mitigate these risks effectively. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes or instability when changing the active slave in a bonded network interface.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file to check for vulnerabilities.
The vulnerability affects all versions of the Linux kernel prior to the fix in version 6.10.9-1 for Debian 13.
Yes, the permanent fix involves upgrading to a patched version of the Linux kernel where the ipsec_lock has been changed to a mutex.
If you cannot upgrade immediately, avoid changing the active slave in bonded interfaces as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
