CVE-2024-41023 sched/deadline: Fix task_struct reference leak
A reference leak in the Linux kernel scheduler can cause memory exhaustion, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41023?
CVE-2024-41023 is a medium-severity memory corruption vulnerability in Linux kernel, published on 29 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sched/deadline: Fix task_struct reference leak
During the execution of the following stress test with linux-rt:
stress-ng --cyclic 30 --timeout 30 --minimize --quiet
kmemleak frequently reported a memory leak concerning the task_struct:
unreferenced object 0xffff8881305b8000 (size 16136): comm "stress-ng", pid 614, jiffies 4294883961 (age 286.412s) object hex dump (first 32 bytes): 02 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .@.............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ debug hex dump (first 16 bytes): 53 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 S............... backtrace: [<00000000046b6790>] dup_task_struct+0x30/0x540 [<00000000c5ca0f0b>] copy_process+0x3d9/0x50e0 [<00000000ced59777>] kernel_clone+0xb0/0x770 [<00000000a50befdc>] __do_sys_clone+0xb6/0xf0 [<000000001dbf2008>] do_syscall_64+0x5d/0xf0 [<00000000552900ff>] entry_SYSCALL_64_after_hwframe+0x6e/0x76
The issue occurs in start_dl_timer(), which increments the task_struct reference count and sets a timer. The timer callback, dl_task_timer, is supposed to decrement the reference count upon expiration. However, if enqueue_task_dl() is called before the timer expires and cancels it, the reference count is not decremented, leading to the leak.
This patch fixes the reference leak by ensuring the task_struct reference count is properly decremented when the timer is canceled.
Weakness: CWE-401
Which versions are affected by CVE-2024-41023?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-41023?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-41023 being exploited?
There is no known exploitation of CVE-2024-41023 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-57740, AZL-57743, BELL-CVE-2024-41023, DEBIAN-CVE-2024-41023, GHSA-v75f-hc9p-6g26, ROOT-OS-DEBIAN-11-CVE-2024-41023 and 3 more.