Executive brief
A race condition was identified in the Linux kernel's networking subsystem (netpoll) that could lead to system instability. The issue occurs when multiple processor cores attempt to access network polling data simultaneously without proper synchronization. While difficult to trigger, an exploit could result in a system crash or denial of service, impacting the availability of the affected server or device.
Technical details
A race condition (CWE-362) exists in the netpoll_owner_active() function within the Linux kernel's networking stack. The vulnerability stems from a non-atomic read of the 'poll_owner' field in the 'napi_struct' while checking if the current CPU owns the lock. KCSAN detected a data race between net_rx_action and netpoll_send_skb, where one CPU writes to the field while another reads it. This lack of synchronization can lead to inconsistent state and potential kernel panics. The fix involves using READ_ONCE() to ensure an atomic read of the poll owner. The vulnerability is reachable by local users and requires specific timing conditions to exploit.
Affected products
- Linux Linux Kernel versions up to 5.10.221, 5.11 to 5.15.162, 5.16 to 6.1.96, 6.2 to 6.6.36, 6.7 to 6.9.7
Timeline
- 2024-07-12: disclosed
- 2024-07-12: advisory: NVD published the CVE record
- 2024-06-27: patched: Fixes committed to various stable kernel branches
References
- https://git.kernel.org/stable/c/3f1a155950a1685ffd0fd7175b3f671da8771f3d
- https://git.kernel.org/stable/c/43c0ca793a18578a0f5b305dd77fcf7ed99f1265
- https://git.kernel.org/stable/c/96826b16ef9c6568d31a1f6ceaa266411a46e46c
- https://git.kernel.org/stable/c/a130e7da73ae93afdb4659842267eec734ffbd57
- https://git.kernel.org/stable/c/c2e6a872bde9912f1a7579639c5ca3adf1003916
- https://git.kernel.org/stable/c/efd29cd9c7b8369dfc7bcb34637e6bf1a188aa8e
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html