CVE-2024-56694 bpf: fix recursive lock when verdict program return SK_PASS
A recursive lock in the Linux kernel BPF subsystem causes a deadlock when a stream verdict program returns SK_PASS, leading to system denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-56694?
CVE-2024-56694 is a high-severity vulnerability in Linux kernel, published on 28 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: fix recursive lock when verdict program return SK_PASS
When the stream_verdict program returns SK_PASS, it places the received skb into its own receive queue, but a recursive lock eventually occurs, leading to an operating system deadlock. This issue has been present since v6.9.
''' sk_psock_strp_data_ready write_lock_bh(&sk->sk_callback_lock) strp_data_ready strp_read_sock read_sock -> tcp_read_sock strp_recv cb.rcv_msg -> sk_psock_strp_read # now stream_verdict return SK_PASS without peer sock assign __SK_PASS = sk_psock_map_verd(SK_PASS, NULL) sk_psock_verdict_apply sk_psock_skb_ingress_self sk_psock_skb_ingress_enqueue sk_psock_data_ready read_lock_bh(&sk->sk_callback_lock) <= dead lock
'''
This topic has been discussed before, but it has not been fixed. Previous discussion: https://lore.kernel.org/all/[email protected]
Weakness: CWE-667
Which versions are affected by CVE-2024-56694?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-56694?
Apply the vendor's patch.
Is CVE-2024-56694 being exploited?
There is no known exploitation of CVE-2024-56694 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-55147, AZL-55203, BELL-CVE-2024-56694, DEBIAN-CVE-2024-56694, GHSA-f225-f9rp-hg69, UBUNTU-CVE-2024-56694.