Critical Vulnerability in Linux Kernel: Ingress and Egress Block Conflict
Summary
DEBIAN-CVE-2024-53044: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext() This command: $ tc qdisc replace dev eth0 ingress_block 1 egress_block 1 clsact Er... Affects linux versions < 6.11.7-1. Fixed in 6.11.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically in the networking subsystem where traffic control (tc) commands are processed. The issue arises when the same block index is requested for both ingress and egress traffic, leading to operational failures.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the net/sched subsystem, specifically in the tcf_block_get_ext() function. This issue occurs when user space requests the same block index for both ingress and egress traffic, resulting in an irrecoverable error state. The failure manifests as a busy flow block error, which can only be resolved by rebooting the system or re-binding the net device driver. The root cause is a missing error teardown path in the code, which fails to properly unbind the flow block when an insertion error occurs.
How To Fix
Minimum fixed version
6.11.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no effective workarounds to avoid this vulnerability aside from applying the patch. Users experiencing issues may need to reboot the system or unbind and rebind the net device driver to recover from the error state.
Conclusion
The identified vulnerability in the Linux kernel poses significant risks to system stability and requires immediate attention. Users are advised to update to the patched version to mitigate these risks. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software ecosystem.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a conflict in the Linux kernel's networking subsystem where the same block index is requested for both ingress and egress traffic, leading to operational failures.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If exploited, this vulnerability can lead to system instability, requiring a reboot or manual intervention to resolve the busy flow block error.
Yes, a patch is available in version 6.11.7-1 or later of the Linux package for both Debian 13 and 14.
If you cannot apply the patch, be aware of the potential for system instability and plan to reboot or rebind the net device driver if you encounter the busy flow block error.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
