CVE-2024-56641 net/smc: initialize close_work early to avoid warning
A race condition in the Linux kernel SMC module can cause a null pointer dereference warning and potential system instability during connection termination.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-56641?
CVE-2024-56641 is a high-severity vulnerability in Linux kernel, published on 27 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/smc: initialize close_work early to avoid warning
We encountered a warning that close_work was canceled before initialization.
WARNING: CPU: 7 PID: 111103 at kernel/workqueue.c:3047 __flush_work+0x19e/0x1b0 Workqueue: events smc_lgr_terminate_work [smc] RIP: 0010:__flush_work+0x19e/0x1b0 Call Trace: ? __wake_up_common+0x7a/0x190 ? work_busy+0x80/0x80 __cancel_work_timer+0xe3/0x160 smc_close_cancel_work+0x1a/0x70 [smc] smc_close_active_abort+0x207/0x360 [smc] __smc_lgr_terminate.part.38+0xc8/0x180 [smc] process_one_work+0x19e/0x340 worker_thread+0x30/0x370 ? process_one_work+0x340/0x340 kthread+0x117/0x130 ? __kthread_cancel_work+0x50/0x50 ret_from_fork+0x22/0x30
This is because when smc_close_cancel_work is triggered, e.g. the RDMA driver is rmmod and the LGR is terminated, the conn->close_work is flushed before initialization, resulting in WARN_ON(!work->func).
__smc_lgr_terminate | smc_connect_{rdma|ism} ------------------------------------------------------------- | smc_conn_create | \- smc_lgr_register_conn for conn in lgr->conns_all | \- smc_conn_kill | \- smc_close_active_abort | \- smc_close_cancel_work | \- cancel_work_sync | \- __flush_work | (close_work) | | smc_close_init | \- INIT_WORK(&close_work)
So fix this by initializing close_work before establishing the connection.
Which versions are affected by CVE-2024-56641?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-56641?
Apply the vendor's patch.
Is CVE-2024-56641 being exploited?
There is no known exploitation of CVE-2024-56641 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-68220, BELL-CVE-2024-56641, DEBIAN-CVE-2024-56641, GHSA-mv4p-vmf8-27c9, ROOT-OS-DEBIAN-11-CVE-2024-56641, ROOT-OS-DEBIAN-12-CVE-2024-56641 and 2 more.