Executive brief
A vulnerability in the Linux kernel's networking subsystem can cause the system to hang or become unresponsive. This occurs when specific network configuration requests are processed in a way that creates an infinite loop, blocking critical system tasks. An attacker with local access could exploit this to cause a denial-of-service, impacting system availability and operations.
Technical details
A vulnerability classified as an infinite loop (CWE-835) exists in the net/sched/act_api.c component of the Linux kernel. The issue occurs in tcf_idr_check_alloc() when a request to add multiple network actions with the same index is processed. The second request can enter an infinite loop while holding the rtnl_lock, leading to task hangs and a denial-of-service condition. The fix replaces the infinite 'goto again' loop with a return of -EAGAIN to properly handle the race condition. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 4.19 to 5.4.279, 5.5 to 5.10.221, 5.11 to 5.15.162, 5.16 to 6.1.96, 6.2 to 6.6.36, 6.7 to 6.9.7
Timeline
- 2024-06-14: patched: Initial patch submitted by David Ruth
- 2024-07-12: disclosed: CVE-2024-40995 published
References
- https://git.kernel.org/stable/c/0d8a2d287c8a394c0d4653f0c6c7be4c688e5a74
- https://git.kernel.org/stable/c/25987a97eec4d5f897cd04ee1b45170829c610da
- https://git.kernel.org/stable/c/5f926aa96b08b6c47178fe1171e7ae331c695fc2
- https://git.kernel.org/stable/c/6fc78d67f51aeb9a542d39a8714e16bc411582d4
- https://git.kernel.org/stable/c/7a0e497b597df7c4cf2b63fc6e9188b6cabe5335
- https://git.kernel.org/stable/c/c6a7da65a296745535a964be1019ec7691b0cb90
- https://git.kernel.org/stable/c/d864319871b05fadd153e0aede4811ca7008f5d6