Deadlock Prevention Vulnerability in Linux Kernel - CVE-2024-58088
Summary
DEBIAN-CVE-2024-58088: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock when freeing cgroup storage The following commit bc235cdb423a ("bpf: Prevent deadlock from recursive bpf_task_storage_[get|delete]") f... Affects linux versions < 6.12.17-1. Fixed in 6.12.17-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It provides essential services for all other parts of the operating system. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically related to the BPF (Berkeley Packet Filter) functionality, which allows for efficient packet filtering and network monitoring.
Vulnerability Detail
In the Linux kernel, a deadlock vulnerability was identified in the BPF subsystem, specifically when freeing cgroup storage. The issue arises from improper handling of locks during the freeing process, which can lead to a deadlock situation. This vulnerability was introduced with the implementation of cgroup storage for BPF programs, where a NULL value was passed instead of the expected busy counter, creating a race condition that could be exploited by malicious programs. The deadlock can occur when multiple tasks attempt to access the same resources simultaneously, potentially leading to system instability or crashes.
How To Fix
Minimum fixed version
6.12.17-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. It is recommended to apply the patch as soon as possible to mitigate the risk of exploitation.
Conclusion
The CVE-2024-58088 vulnerability in the Linux kernel poses a significant risk due to potential deadlocks when freeing cgroup storage. It is crucial for users to update their systems to the patched version to ensure stability and security. Regular monitoring using tools like Vulert can help in identifying such vulnerabilities in the future.
See every vulnerability recorded for linux →
FAQ
CVE-2024-58088 is a vulnerability in the Linux kernel that can lead to a deadlock when freeing cgroup storage, affecting system stability.
The vulnerability affects the Linux kernel versions in Debian 13 and 14 prior to version 6.12.17-1.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Exploitation of this vulnerability can lead to system deadlocks, causing instability and crashes, which may affect the availability of services.
Currently, the best way to mitigate the risk is to apply the patch. No specific workarounds are available.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
