Data Race Vulnerability in Linux Kernel - linux Package
Summary
DEBIAN-CVE-2024-53160: In the Linux kernel, the following vulnerability has been resolved: rcu/kvfree: Fix data-race in mod_timer / kvfree_call_rcu KCSAN reports a data race when access the krcp->monitor_work.timer.expires variable in the sche... Affects linux versions < 6.12.3-1. Fixed in 6.12.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is crucial for system stability and performance. This vulnerability affects versions prior to 6.12.3-1, where a data race condition can occur, potentially leading to unpredictable behavior and system crashes.
Vulnerability Detail
In the Linux kernel, a data race has been identified in the functions __mod_timer and kvfree_call_rcu. This race condition arises when multiple tasks access the krcp->monitor_work.timer.expires variable without proper synchronization, leading to inconsistent states and potential system instability. The issue was reported by Kernel Concurrency Sanitizer, indicating that it can be exploited under certain conditions, affecting the reliability of the kernel's timer management.
How To Fix
Minimum fixed version
6.12.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The identified data race vulnerability in the Linux kernel's linux package poses a significant risk to system stability. Users are urged to update to the patched version 6.12.3-1 to mitigate this issue. Regular updates and monitoring for vulnerabilities are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
A data race occurs when two or more tasks access shared data concurrently, and at least one of the accesses is a write. This can lead to unpredictable behavior and bugs.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The consequences may include system crashes, data corruption, and unpredictable behavior of applications relying on the kernel's timer management.
While the vulnerability is technical in nature, it could potentially be exploited in specific scenarios, leading to system instability.
It is recommended to regularly check for and apply updates to your packages to ensure you have the latest security patches and improvements.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
