Bug 2297579 (CVE-2024-40995) - CVE-2024-40995 kernel: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
Summary: CVE-2024-40995 kernel: net/sched: act_api: fix possible infinite loop in tcf_...
Keywords:
Status: NEW
Alias: CVE-2024-40995
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-07-12 13:48 UTC by OSIDB Bzimport
Modified: 2024-11-07 15:10 UTC (History)
4 users (show)

Fixed In Version: kernel 5.4.279, kernel 5.10.221, kernel 5.15.162, kernel 6.1.96, kernel 6.6.36, kernel 6.9.7, kernel 6.10-rc5
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:7043 0 None None None 2024-09-24 09:43:11 UTC
Red Hat Product Errata RHBA-2024:7198 0 None None None 2024-09-26 09:50:52 UTC
Red Hat Product Errata RHBA-2024:7236 0 None None None 2024-09-26 14:33:23 UTC
Red Hat Product Errata RHBA-2024:7637 0 None None None 2024-10-03 14:45:59 UTC
Red Hat Product Errata RHBA-2024:8227 0 None None None 2024-10-17 06:46:02 UTC
Red Hat Product Errata RHBA-2024:9014 0 None None None 2024-11-07 15:10:49 UTC
Red Hat Product Errata RHSA-2024:5672 0 None None None 2024-08-21 00:26:28 UTC
Red Hat Product Errata RHSA-2024:5673 0 None None None 2024-08-21 00:15:07 UTC
Red Hat Product Errata RHSA-2024:6156 0 None None None 2024-09-03 05:50:19 UTC
Red Hat Product Errata RHSA-2024:6160 0 None None None 2024-09-03 05:33:17 UTC
Red Hat Product Errata RHSA-2024:6990 0 None None None 2024-09-24 00:24:42 UTC
Red Hat Product Errata RHSA-2024:6991 0 None None None 2024-09-24 00:47:32 UTC
Red Hat Product Errata RHSA-2024:6993 0 None None None 2024-09-24 01:14:52 UTC
Red Hat Product Errata RHSA-2024:7000 0 None None None 2024-09-24 02:34:37 UTC
Red Hat Product Errata RHSA-2024:7001 0 None None None 2024-09-24 00:39:20 UTC
Red Hat Product Errata RHSA-2024:8617 0 None None None 2024-10-30 01:26:41 UTC

Description OSIDB Bzimport 2024-07-12 13:48:38 UTC
In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()

syzbot found hanging tasks waiting on rtnl_lock [1]

A reproducer is available in the syzbot bug.

When a request to add multiple actions with the same index is sent, the
second request will block forever on the first request. This holds
rtnl_lock, and causes tasks to hang.

Return -EAGAIN to prevent infinite looping, while keeping documented
behavior.

[1]

INFO: task kworker/1:0:5088 blocked for more than 143 seconds.
Not tainted 6.9.0-rc4-syzkaller-00173-g3cdb45594619 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:0 state:D stack:23744 pid:5088 tgid:5088 ppid:2 flags:0x00004000
Workqueue: events_power_efficient reg_check_chans_work
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5409 [inline]
__schedule+0xf15/0x5d00 kernel/sched/core.c:6746
__schedule_loop kernel/sched/core.c:6823 [inline]
schedule+0xe7/0x350 kernel/sched/core.c:6838
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6895
__mutex_lock_common kernel/locking/mutex.c:684 [inline]
__mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752
wiphy_lock include/net/cfg80211.h:5953 [inline]
reg_leave_invalid_chans net/wireless/reg.c:2466 [inline]
reg_check_chans_work+0x10a/0x10e0 net/wireless/reg.c:2481

Comment 131 errata-xmlrpc 2024-08-21 00:15:06 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:5673 https://access.redhat.com/errata/RHSA-2024:5673

Comment 132 errata-xmlrpc 2024-08-21 00:26:27 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:5672 https://access.redhat.com/errata/RHSA-2024:5672

Comment 133 errata-xmlrpc 2024-09-03 05:33:16 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2024:6160 https://access.redhat.com/errata/RHSA-2024:6160

Comment 134 errata-xmlrpc 2024-09-03 05:50:18 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2024:6156 https://access.redhat.com/errata/RHSA-2024:6156

Comment 135 errata-xmlrpc 2024-09-24 00:24:41 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2024:6990 https://access.redhat.com/errata/RHSA-2024:6990

Comment 136 errata-xmlrpc 2024-09-24 00:39:19 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:7001 https://access.redhat.com/errata/RHSA-2024:7001

Comment 137 errata-xmlrpc 2024-09-24 00:47:31 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2024:6991 https://access.redhat.com/errata/RHSA-2024:6991

Comment 138 errata-xmlrpc 2024-09-24 01:14:51 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:6993 https://access.redhat.com/errata/RHSA-2024:6993

Comment 139 errata-xmlrpc 2024-09-24 02:34:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:7000 https://access.redhat.com/errata/RHSA-2024:7000

Comment 140 errata-xmlrpc 2024-10-30 01:26:40 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:8617 https://access.redhat.com/errata/RHSA-2024:8617


Note You need to log in before you can comment on or make changes to this bug.