CVE-2024-27010: linux-libc-dev - Fix mirred deadlock on device recursion
Summary
CVE-2024-27010: In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix mirred deadlock on device recursion When the mirred action is used on a classful egress qdisc and a packet is mirrored or redirected to s... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The linux-libc-dev package is a development package for the Linux kernel. It provides the necessary header files and libraries for compiling programs that interact with the kernel. This package is an essential component for building and running applications on Linux systems. The vulnerability identified as CVE-2024-27010 affects the linux-libc-dev package and can lead to a deadlock in the network scheduler (net/sched) when using the mirred action on a classful egress qdisc. This vulnerability can cause a recursive locking scenario, resulting in a deadlock and potential system instability.
Vulnerability Detail
The vulnerability arises from a deadlock in the network scheduler when the mirred action is used on a classful egress qdisc and a packet is mirrored or redirected to itself. This can trigger a qdisc lock deadlock, leading to a possible recursive locking scenario. The deadlock can be observed in the kernel trace, and it has the potential to cause system instability. The vulnerability has been addressed by adding an owner field (CPU id) to struct Qdisc set after the root qdisc is entered. This fix ensures that when the softirq enters the qdisc a second time, if the qdisc owner is the same CPU, the packet is dropped to break the loop.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the linux-libc-dev package is not immediately possible, a workaround can be implemented by modifying the network configuration. Two example setups are provided:
-
eth0->eth0: tc qdisc add dev eth0 root handle 1: htb default 30 tc filter add dev eth0 handle 1: protocol ip prio 2 matchall action mirred egress redirect dev eth0
-
eth0->eth1->eth0: tc qdisc add dev eth0 root handle 1: htb default 30 tc filter add dev eth0 handle 1: protocol ip prio 2 matchall action mirred egress redirect dev eth1 tc qdisc add dev eth1 root handle 1: htb default 30 tc filter add dev eth1 handle 1: protocol ip prio 2 matchall action mirred egress redirect dev eth0
Implementing these workarounds can help mitigate the risk of encountering the deadlock.
Conclusion
The vulnerability in the linux-libc-dev package has been addressed with the release of version 6.1.90-1. It is crucial to update the package to ensure the security and stability of the system. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The linux-libc-dev package is a development package for the Linux kernel. It provides the necessary header files and libraries for compiling programs that interact with the kernel.
A classful egress qdisc is a queuing discipline used in network traffic management. It allows for the classification and prioritization of outgoing packets based on various criteria.
You can check the version of linux-libc-dev installed on your system by running the following command: dpkg -l linux-libc-dev
No, this vulnerability affects the linux-libc-dev package in general and can potentially impact any Linux distribution that utilizes this package.
The CVSS score of this vulnerability is 5.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
