Junglewise Threat Intelligence

CVE-2024-47710: Linux Kernel soft lockup in sock_hash_free

CVE-2024-47710 · Severity: medium · CVSS 5.5 · Published 2024-10-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user to cause a system hang or 'soft lockup.' This occurs when the system attempts to clean up large internal data structures used for managing network sockets, consuming all available processor time without yielding. This can lead to a denial-of-service condition where the system becomes unresponsive to other tasks.

Technical details

A vulnerability in `net/core/sock_map.c` within the Linux kernel's BPF sock_map implementation can lead to a soft lockup. The `sock_hash_free()` function, responsible for destroying socket hash maps, lacks a `cond_resched()` call within its bucket processing loop. When a map with a very large number of buckets is destroyed, the kernel may spend an excessive amount of time in this loop without yielding the CPU to other tasks. A local attacker with the ability to create and destroy large BPF maps could exploit this to trigger a denial-of-service (DoS) condition. Patches have been released across multiple stable kernel branches to add the necessary rescheduling point.

Affected products

  • Linux Linux Kernel 5.4.49 to 5.5, 5.7.6 to 5.8, 5.8 to 5.10.227, 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.6.54, 6.7 to 6.10.13, 6.11 to 6.11.2

Timeline

  • 2024-10-21: advisory: Initial publication of CVE-2024-47710
  • 2024-10-17: patched: Fixes committed to various stable kernel branches

References

Related threats