CVE-2024-26740: linux-libc-dev - net/sched: act_mirred: use the backlog for mirred ingress
Summary
CVE-2024-26740: In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: use the backlog for mirred ingress The test Davide added in commit ca22da2fbd69 ("act_mirred: use the backlog for nested calls to... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-libc-dev package is a development package that provides the necessary header files and libraries for compiling programs that use the Linux kernel's C library. It is an essential component for building and running applications on Linux systems. The vulnerability in question affects the act_mirred module in the kernel's network scheduler (net/sched).
Vulnerability Detail
The vulnerability (CVE-2024-26740) addressed in this report involves a deadlock issue in the act_mirred module of the Linux kernel's network scheduler. When traffic flow is reversed with a redirect (egress -> ingress), it is possible to reach the same socket that generated the packet while still holding its socket lock. This can lead to a deadlock situation, causing the system to hang. The solution implemented is to put the packet in the Rx backlog instead of running it inline, preventing the deadlock. The vulnerability has a CVSS score of 5.5, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The linux-libc-dev package is vulnerable to a deadlock issue in the act_mirred module of the kernel's network scheduler. To mitigate this vulnerability, it is crucial to update the package to version 6.1.90-1 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a development package that provides header files and libraries for compiling programs that use the Linux kernel's C library.
The act_mirred module is part of the Linux kernel's network scheduler (net/sched) and is responsible for mirroring network traffic.
A deadlock is a situation where two or more processes are unable to proceed because each is waiting for the other to release a resource.
The CVSS score of this vulnerability is 5.5, indicating a medium severity level.
You can update the linux-libc-dev package by running the package manager's update command or using the appropriate package management tool for your Linux distribution.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
