CVE-2024-49976 tracing/timerlat: Drop interface_lock in stop_kthread()
A race condition in the Linux kernel's timerlat tracing subsystem can cause a deadlock, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-49976?
CVE-2024-49976 is a medium-severity vulnerability in Linux kernel, published on 21 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tracing/timerlat: Drop interface_lock in stop_kthread()
stop_kthread() is the offline callback for "trace/osnoise:online", since commit 5bfbcd1ee57b ("tracing/timerlat: Add interface_lock around clearing of kthread in stop_kthread()"), the following ABBA deadlock scenario is introduced:
T1 | T2 [BP] | T3 [AP] osnoise_hotplug_workfn() | work_for_cpu_fn() | cpuhp_thread_fun() | _cpu_down() | osnoise_cpu_die() mutex_lock(&interface_lock) | | stop_kthread() | cpus_write_lock() | mutex_lock(&interface_lock) cpus_read_lock() | cpuhp_kick_ap() |
As the interface_lock here in just for protecting the "kthread" field of the osn_var, use xchg() instead to fix this issue. Also use for_each_online_cpu() back in stop_per_cpu_kthreads() as it can take cpu_read_lock() again.
Weakness: CWE-667
Which versions are affected by CVE-2024-49976?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-49976?
Apply the vendor's patch.
Is CVE-2024-49976 being exploited?
There is no known exploitation of CVE-2024-49976 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-49976, DEBIAN-CVE-2024-49976, GHSA-8j66-8f4j-h263, UBUNTU-CVE-2024-49976.