PT-2024-29225 · Linux+6 · Linux Kernel+6
Published
2024-07-09
·
Updated
2026-05-26
·
CVE-2024-41045
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to the bpf timer cancel and free function in the Linux kernel, where two timer callbacks trying to cancel each other can lead to a deadlock situation. This can be invoked through bpf map update elem, specifically when freeing map elements containing timers. The problem can be fixed by using hrtimer try to cancel, as the timer cannot be enqueued after async cancel and free. However, there exists a UAF scenario where the callback arms the timer before entering this function, and if cancellation fails, the RCU grace period expiration can free the bpf hrtimer state and the struct hrtimer. To resolve this, the bpf timer cancel and free function is modified to defer work to the global workqueue, adding a work struct alongside rcu head.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Suse
Ubuntu