Junglewise Threat Intelligence

CVE-2024-35895: Linux Kernel lock inversion deadlock in BPF sockmap

CVE-2024-35895 · Severity: medium · CVSS 5.5 · Published 2024-05-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local attacker to cause a system deadlock, leading to a complete service outage. The issue occurs when specific background tracing programs attempt to delete network socket information while the system is handling hardware interrupts. This results in a 'lock inversion' where the system becomes stuck waiting for resources that will never be released.

Technical details

A deadlock vulnerability exists in the BPF sockmap and sockhash components of the Linux kernel due to improper lock management. BPF tracing programs, which can be invoked from any interrupt context, may attempt to delete elements from a sockmap using map_delete_elem. Because the locks used in sockmap are not hardirq-safe by design, invoking these operations when interrupts are disabled can lead to a lock inversion deadlock. The fix involves detecting if map_delete_elem is called from a context where interrupts are disabled and returning an error (EOPNOTSUPP) to prevent the deadlock. This issue primarily affects availability (Denial of Service).

Affected products

  • Linux Linux Kernel 4.20 to 5.4.274, 5.5 to 5.10.215, 5.11 to 5.15.154, 5.16 to 6.1.85, 6.2 to 6.6.26, 6.7 to 6.8.5

Timeline

  • 2024-04-10: patched: Commits merged into various stable branches.
  • 2024-05-19: disclosed: Initial publication of the CVE.

References

Related threats