Deadlock Vulnerability in Linux Kernel's Mirred Ingress Functionality
Summary
DEBIAN-CVE-2024-26740: In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: use the backlog for mirred ingress The test Davide added in commit ca22da2fbd69 ("act_mirred: use the backlog for nested calls to... Affects linux versions < 6.7.7-1. Fixed in 6.7.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of a Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used in various distributions, including Debian. The kernel's networking subsystem includes features like traffic control and packet scheduling, which are essential for managing data flow. The vulnerability in question affects the mirred ingress functionality, which is designed to redirect packets from one interface to another. This vulnerability can lead to deadlocks, causing system instability and potential denial of service.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the net/sched component related to the act_mirred functionality. This issue arises when traffic flow is reversed from egress to ingress, potentially leading to a deadlock situation where the same socket that generated the packet is still holding its socket lock. The deadlock can manifest during testing, causing virtual machines to hang. The vulnerability was introduced in a commit that attempted to improve the handling of nested calls to mirred ingress but inadvertently created a scenario where packets could be processed inline, leading to the deadlock. The common mitigation strategy involves using the Rx backlog for packet handling instead of processing them directly.
How To Fix
Minimum fixed version
6.7.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if immediate patching is not possible, consider avoiding the use of the mirred ingress functionality until the update can be applied. This may help prevent the deadlock situation from occurring during network operations.
Conclusion
The deadlock vulnerability in the Linux kernel's mirred ingress functionality poses a significant risk to system stability. It is crucial for users of Debian 13 and 14 to update their Linux packages to the patched version 6.7.7-1 to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to deadlocks in the system, causing virtual machines to hang and potentially resulting in denial of service.
You can use tools like Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability affects the Linux package in Debian 13 and 14 prior to version 6.7.7-1.
Yes, updating the Linux package to version 6.7.7-1 or later will permanently fix the vulnerability.
If you cannot update immediately, consider avoiding the use of the mirred ingress functionality as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
