Bug 2300381 (CVE-2024-41023) - CVE-2024-41023 kernel: sched/deadline: Fix task_struct reference leak
Summary: CVE-2024-41023 kernel: sched/deadline: Fix task_struct reference leak
Keywords:
Status: NEW
Alias: CVE-2024-41023
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2300928
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-07-29 15:20 UTC by OSIDB Bzimport
Modified: 2025-05-05 13:20 UTC (History)
6 users (show)

Fixed In Version: kernel 6.9.10, kernel 6.10
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:7043 0 None None None 2024-09-24 09:43:20 UTC
Red Hat Product Errata RHBA-2024:7198 0 None None None 2024-09-26 09:49:02 UTC
Red Hat Product Errata RHBA-2024:7236 0 None None None 2024-09-26 14:37:52 UTC
Red Hat Product Errata RHBA-2024:7637 0 None None None 2024-10-03 14:46:09 UTC
Red Hat Product Errata RHBA-2024:8227 0 None None None 2024-10-17 06:46:23 UTC
Red Hat Product Errata RHSA-2024:10262 0 None None None 2024-11-26 00:48:27 UTC
Red Hat Product Errata RHSA-2024:6744 0 None None None 2024-09-18 00:17:25 UTC
Red Hat Product Errata RHSA-2024:6745 0 None None None 2024-09-18 00:06:43 UTC
Red Hat Product Errata RHSA-2024:7000 0 None None None 2024-09-24 02:35:01 UTC
Red Hat Product Errata RHSA-2024:9546 0 None None None 2024-11-13 15:48:47 UTC

Description OSIDB Bzimport 2024-07-29 15:20:41 UTC
In the Linux kernel, the following vulnerability has been resolved:

sched/deadline: Fix task_struct reference leak

During the execution of the following stress test with linux-rt:

stress-ng --cyclic 30 --timeout 30 --minimize --quiet

kmemleak frequently reported a memory leak concerning the task_struct:

unreferenced object 0xffff8881305b8000 (size 16136):
  comm "stress-ng", pid 614, jiffies 4294883961 (age 286.412s)
  object hex dump (first 32 bytes):
    02 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00  .@..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  debug hex dump (first 16 bytes):
    53 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00  S...............
  backtrace:
    [<00000000046b6790>] dup_task_struct+0x30/0x540
    [<00000000c5ca0f0b>] copy_process+0x3d9/0x50e0
    [<00000000ced59777>] kernel_clone+0xb0/0x770
    [<00000000a50befdc>] __do_sys_clone+0xb6/0xf0
    [<000000001dbf2008>] do_syscall_64+0x5d/0xf0
    [<00000000552900ff>] entry_SYSCALL_64_after_hwframe+0x6e/0x76

The issue occurs in start_dl_timer(), which increments the task_struct
reference count and sets a timer. The timer callback, dl_task_timer,
is supposed to decrement the reference count upon expiration. However,
if enqueue_task_dl() is called before the timer expires and cancels it,
the reference count is not decremented, leading to the leak.

This patch fixes the reference leak by ensuring the task_struct
reference count is properly decremented when the timer is canceled.

Comment 1 Mauro Matteo Cascella 2024-07-29 19:24:32 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2300928]

Comment 11 errata-xmlrpc 2024-09-18 00:06:42 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:6745 https://access.redhat.com/errata/RHSA-2024:6745

Comment 12 errata-xmlrpc 2024-09-18 00:17:24 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:6744 https://access.redhat.com/errata/RHSA-2024:6744

Comment 13 errata-xmlrpc 2024-09-24 02:35:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:7000 https://access.redhat.com/errata/RHSA-2024:7000

Comment 15 errata-xmlrpc 2024-11-13 15:48:46 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2024:9546 https://access.redhat.com/errata/RHSA-2024:9546

Comment 16 errata-xmlrpc 2024-11-26 00:48:26 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:10262 https://access.redhat.com/errata/RHSA-2024:10262


Note You need to log in before you can comment on or make changes to this bug.