Critical Vulnerability in Linux Kernel: BPF Timer Defer Work Issue
Summary
DEBIAN-CVE-2024-41045: In the Linux kernel, the following vulnerability has been resolved: bpf: Defer work in bpf_timer_cancel_and_free Currently, the same case as previous patch (two timer callbacks trying to cancel each other) can be invoked... Affects linux versions < 6.9.10-1. Fixed in 6.9.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its robustness and versatility, powering everything from servers to embedded systems. However, like any complex software, it is susceptible to vulnerabilities. This specific vulnerability affects the BPF (Berkeley Packet Filter) subsystem, which is used for network packet filtering and monitoring. The issue arises from improper handling of timer callbacks, leading to potential deadlocks and use-after-free scenarios.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the BPF subsystem related to timer management. The issue occurs when two timer callbacks attempt to cancel each other, which can lead to a deadlock situation. This vulnerability can be exploited through the bpf_map_update_elem function, particularly when freeing map elements that contain timers. The root cause lies in the reliance on hrtimer_cancel, which can fail under certain conditions, leading to a use-after-free (UAF) scenario. If the timer expiration is significantly far in the future, the RCU grace period may expire before the timer is freed, resulting in potential exploitation.
How To Fix
Minimum fixed version
6.9.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The identified vulnerability in the Linux kernel's BPF subsystem poses significant risks, including potential deadlocks and use-after-free scenarios. It is crucial for users to update their systems to the patched version to mitigate these risks. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of timer callbacks in the BPF subsystem of the Linux kernel, leading to potential deadlocks and use-after-free scenarios.
An attacker could exploit this vulnerability by manipulating timer callbacks, potentially leading to system instability or unauthorized access.
The vulnerability affects the Linux kernel versions prior to 6.9.10-1 in Debian 13 and Debian 14.
Yes, a patch is available in version 6.9.10-1 for both Debian 13 and Debian 14.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application for vulnerabilities without signup at the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
