CVE-2024-26740

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_mirred: use the backlog for mirred ingress

The test Davide added in commit ca22da2fbd69 ("act_mirred: use the backlog

for nested calls to mirred ingress") hangs our testing VMs every 10 or so

runs, with the familiar tcp_v4_rcv -> tcp_v4_rcv deadlock reported by

lockdep.

The problem as previously described by Davide (see Link) is that

if we reverse flow of traffic with the redirect (egress -> ingress)

we may reach the same socket which generated the packet. And we may

still be holding its socket lock. The common solution to such deadlocks

is to put the packet in the Rx backlog, rather than run the Rx path

inline. Do that for all egress -> ingress reversals, not just once

we started to nest mirred calls.

In the past there was a concern that the backlog indirection will

lead to loss of error reporting / less accurate stats. But the current

workaround does not seem to address the issue.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References