Critical Deadlock Vulnerability in Linux Kernel: IDLETIMER Package
Summary
DEBIAN-CVE-2024-54683: In the Linux kernel, the following vulnerability has been resolved: netfilter: IDLETIMER: Fix for possible ABBA deadlock Deletion of the last rule referencing a given idletimer may happen at the same time as a read of it... Affects linux versions < 6.12.6-1. Fixed in 6.12.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used in various distributions, including Debian. The kernel's netfilter subsystem, which provides packet filtering, network address translation, and other packet mangling, has been identified to have a vulnerability in the IDLETIMER feature that can lead to a potential deadlock situation.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the netfilter subsystem related to the IDLETIMER feature. The issue arises when the last rule referencing a specific idletimer is deleted while simultaneously being read from its sysfs file. This can lead to a circular locking dependency, resulting in a deadlock. The warning message indicates that a task is trying to acquire a lock that is already held by another task, which can disrupt normal operations and lead to system instability. The vulnerability is present in versions prior to 6.12.6-1.
How To Fix
Minimum fixed version
6.12.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid triggering the deadlock by refraining from simultaneously deleting and reading idletimer rules. A simple script to demonstrate this is as follows:
#!/bin/bash while true; do
iptables -A INPUT -i foo -j IDLETIMER --timeout 10 --label "testme"
iptables -D INPUT -i foo -j IDLETIMER --timeout 10 --label "testme"
done & while true; do cat /sys/class/xt_idletimer/timers/testme >/dev/null done
Conclusion
The vulnerability in the Linux kernel's IDLETIMER feature poses a significant risk of deadlock, affecting system stability. Users are advised to update their Linux packages to the patched version to mitigate this risk. Temporary workarounds can be employed until the update is feasible.
See every vulnerability recorded for linux →
FAQ
The IDLETIMER feature in the Linux kernel allows users to set timeouts for specific network connections, enabling automated management of idle connections.
You can check if your application is affected by this vulnerability using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without any signup.
The primary risk is the potential for a deadlock situation, which can lead to system instability and affect the performance of network operations.
Yes, the permanent fix is to update the Linux kernel to version 6.12.6-1 or later, which resolves the deadlock issue.
If an immediate update is not possible, implement the provided workaround to avoid triggering the deadlock until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
