PT-2024-34046 · Linux+6 · Linux Kernel+6
Published
2024-10-18
·
Updated
2025-10-31
·
CVE-2024-50210
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 6.6.61
Description:
The issue is related to unbalanced locking in the
pc clock settime() function. When get clock desc() succeeds, it calls fget() for the clockid's fd and gets the clk->rwsem read lock. However, the error path should release the lock to make the lock balance and fput the clockid's fd to make the refcount balance and release the fd related resource. The problem was caused by a commit that left the error path locked behind, resulting in unbalanced locking. To fix this, timespec64 valid strict() should be checked before get clock desc(), as the "ts" is not changed after that.Recommendations:
For Linux kernel versions prior to 6.6.61, update to version 6.6.61 or later to resolve the issue. As a temporary workaround, consider restricting access to the
pc clock settime() function until a patch is available. Additionally, ensure that the timespec64 valid strict() check is performed before calling get clock desc() to prevent unbalanced locking.Exploit
Fix
Improper Locking
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu