Circular Locking Dependency in Linux Kernel - CVE-2024-54683
Summary
CVE-2024-54683: In the Linux kernel, the following vulnerability has been resolved: netfilter: IDLETIMER: Fix for possible ABBA deadlock Deletion of the last rule referencing a given idletimer may happen at the same time as a read of it... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to software applications. It is known for its robustness and flexibility, supporting a wide range of devices and architectures. However, vulnerabilities can arise due to complex interactions within its subsystems, such as netfilter, which handles packet filtering and network address translation. The specific vulnerability identified as CVE-2024-54683 pertains to a potential deadlock scenario in the idletimer functionality, which could impact system stability.
Vulnerability Detail
CVE-2024-54683 is a vulnerability in the Linux kernel's netfilter subsystem, specifically related to the idletimer feature. The issue arises when the deletion of the last rule referencing a given idletimer occurs simultaneously with a read operation from its sysfs file. This can lead to a circular locking dependency, where one task is trying to acquire a lock that another task is already holding, resulting in a deadlock situation. The ramifications of this vulnerability include potential system hangs or crashes, which can severely affect system performance and reliability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
A simple workaround to avoid triggering the vulnerability is to ensure that the deletion of idletimer rules and the reading of their sysfs files do not occur simultaneously. This can be achieved by implementing proper synchronization mechanisms in scripts that manipulate iptables. Here is an example of a script that avoids the issue:
#!/bin/bash
while true; do
iptables -A INPUT -i foo -j IDLETIMER --timeout 10 --label "testme"
sleep 1
iptables -D INPUT -i foo -j IDLETIMER --timeout 10 --label "testme"
sleep 1
done &
while true; do cat /sys/class/xt_idletimer/timers/testme >/dev/null sleep 1 done
Conclusion
CVE-2024-54683 is a significant vulnerability in the Linux kernel that can lead to deadlock situations, impacting system stability. Users are advised to update their systems to the latest patched version to mitigate risks. Additionally, implementing workarounds can help avoid potential issues until the update is applied.
See every vulnerability recorded for linux →
FAQ
CVE-2024-54683 is a vulnerability in the Linux kernel related to a circular locking dependency in the netfilter idletimer functionality.
The vulnerability can lead to system hangs or crashes due to deadlock situations, affecting system performance and reliability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Update your Linux kernel to the patched version 6.12.6-1 or later to mitigate the vulnerability.
Yes, implementing proper synchronization in scripts that manipulate iptables can help avoid triggering the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
