CVE-2024-39296 bonding: fix oops during rmmod
A null pointer dereference in the Linux kernel bonding module during removal can cause a system crash, requiring a patch to reorder cleanup operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-39296?
CVE-2024-39296 is a medium-severity vulnerability in Linux kernel, published on 25 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bonding: fix oops during rmmod
"rmmod bonding" causes an oops ever since commit cc317ea3d927 ("bonding: remove redundant NULL check in debugfs function"). Here are the relevant functions being called:
bonding_exit() bond_destroy_debugfs() debugfs_remove_recursive(bonding_debug_root); bonding_debug_root = NULL; <--------- SET TO NULL HERE bond_netlink_fini() rtnl_link_unregister() __rtnl_link_unregister() unregister_netdevice_many_notify() bond_uninit() bond_debug_unregister() (commit removed check for bonding_debug_root == NULL) debugfs_remove() simple_recursive_removal() down_write() -> OOPS
However, reverting the bad commit does not solve the problem completely because the original code contains a race that could cause the same oops, although it was much less likely to be triggered unintentionally:
CPU1 rmmod bonding bonding_exit() bond_destroy_debugfs() debugfs_remove_recursive(bonding_debug_root);
CPU2 echo -bond0 > /sys/class/net/bonding_masters bond_uninit() bond_debug_unregister() if (!bonding_debug_root)
CPU1 bonding_debug_root = NULL;
So do NOT revert the bad commit (since the removed checks were racy anyway), and instead change the order of actions taken during module removal. The same oops can also happen if there is an error during module init, so apply the same fix there.
Which versions are affected by CVE-2024-39296?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-39296?
Apply the vendor's patch.
Is CVE-2024-39296 being exploited?
There is no known exploitation of CVE-2024-39296 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-39296, DEBIAN-CVE-2024-39296, GHSA-rw9r-wqx2-72f7, UBUNTU-CVE-2024-39296.