CVE-2024-41045

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Defer work in bpf_timer_cancel_and_free

Currently, the same case as previous patch (two timer callbacks trying

to cancel each other) can be invoked through bpf_map_update_elem as

well, or more precisely, freeing map elements containing timers. Since

this relies on hrtimer_cancel as well, it is prone to the same deadlock

situation as the previous patch.

It would be sufficient to use hrtimer_try_to_cancel to fix this problem,

as the timer cannot be enqueued after async_cancel_and_free. Once

async_cancel_and_free has been done, the timer must be reinitialized

before it can be armed again. The callback running in parallel trying to

arm the timer will fail, and freeing bpf_hrtimer without waiting is

sufficient (given kfree_rcu), and bpf_timer_cb will return

HRTIMER_NORESTART, preventing the timer from being rearmed again.

However, there exists a UAF scenario where the callback arms the timer

before entering this fu

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References