CVE-2024-53160

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu

KCSAN reports a data race when access the krcp->monitor_work.timer.expires

variable in the schedule_delayed_monitor_work() function:

<snip>

BUG: KCSAN: data-race in __mod_timer / kvfree_call_rcu

read to 0xffff888237d1cce8 of 8 bytes by task 10149 on cpu 1:

schedule_delayed_monitor_work kernel/rcu/tree.c:3520 [inline]

kvfree_call_rcu+0x3b8/0x510 kernel/rcu/tree.c:3839

trie_update_elem+0x47c/0x620 kernel/bpf/lpm_trie.c:441

bpf_map_update_value+0x324/0x350 kernel/bpf/syscall.c:203

generic_map_update_batch+0x401/0x520 kernel/bpf/syscall.c:1849

bpf_map_do_batch+0x28c/0x3f0 kernel/bpf/syscall.c:5143

__sys_bpf+0x2e5/0x7a0

__do_sys_bpf kernel/bpf/syscall.c:5741 [inline]

__se_sys_bpf kernel/bpf/syscall.c:5739 [inline]

__x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5739

x64_sys_call+0x2625/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:322

do_syscall_x

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References