CVE-2024-42239

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fail bpf_timer_cancel when callback is being cancelled

Given a schedule:

timer1 cb timer2 cb

bpf_timer_cancel(timer2); bpf_timer_cancel(timer1);

Both bpf_timer_cancel calls would wait for the other callback to finish

executing, introducing a lockup.

Add an atomic_t count named 'cancelling' in bpf_hrtimer. This keeps

track of all in-flight cancellation requests for a given BPF timer.

Whenever cancelling a BPF timer, we must check if we have outstanding

cancellation requests, and if so, we must fail the operation with an

error (-EDEADLK) since cancellation is synchronous and waits for the

callback to finish executing. This implies that we can enter a deadlock

situation involving two or more timer callbacks executing in parallel

and attempting to cancel one another.

Note that we avoid incrementing the cancelling counter for the target

timer (the one being cancelled) if bpf_timer_cancel is not invoked from

a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References