CVE-2024-41001 io_uring/sqpoll: work around a potential audit memory leak
A memory leak in the Linux kernel's io_uring subsystem can lead to resource exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41001?
CVE-2024-41001 is a medium-severity denial of service vulnerability in Linux kernel, published on 12 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
io_uring/sqpoll: work around a potential audit memory leak
kmemleak complains that there's a memory leak related to connect handling:
unreferenced object 0xffff0001093bdf00 (size 128): comm "iou-sqp-455", pid 457, jiffies 4294894164 hex dump (first 32 bytes): 02 00 fa ea 7f 00 00 01 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 2e481b1a): [<00000000c0a26af4>] kmemleak_alloc+0x30/0x38 [<000000009c30bb45>] kmalloc_trace+0x228/0x358 [<000000009da9d39f>] __audit_sockaddr+0xd0/0x138 [<0000000089a93e34>] move_addr_to_kernel+0x1a0/0x1f8 [<000000000b4e80e6>] io_connect_prep+0x1ec/0x2d4 [<00000000abfbcd99>] io_submit_sqes+0x588/0x1e48 [<00000000e7c25e07>] io_sq_thread+0x8a4/0x10e4 [<00000000d999b491>] ret_from_fork+0x10/0x20
which can can happen if:
1) The command type does something on the prep side that triggers an audit call. 2) The thread hasn't done any operations before this that triggered an audit call inside ->issue(), where we have audit_uring_entry() and audit_uring_exit().
Work around this by issuing a blanket NOP operation before the SQPOLL does anything.
Weakness: CWE-401
Which versions are affected by CVE-2024-41001?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-41001?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-41001 being exploited?
There is no known exploitation of CVE-2024-41001 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-47928, BELL-CVE-2024-41001, DEBIAN-CVE-2024-41001, GHSA-25v2-v763-x228, ROOT-OS-DEBIAN-11-CVE-2024-41001, ROOT-OS-UBUNTU-2204-CVE-2024-41001 and 1 more.