Executive brief
A vulnerability in the Linux kernel's POSIX clock subsystem could allow a local user to cause a system hang or crash. The issue stems from a locking error where the system fails to release internal resources properly when an invalid time value is provided. This can lead to a denial-of-service condition, impacting the availability of the affected server or device.
Technical details
A locking imbalance exists in the pc_clock_settime() function within kernel/time/posix-clock.c. When get_clock_desc() succeeds, it acquires a read lock (clk->rwsem) and increments a file descriptor reference count via fget(). A subsequent validation check using timespec64_valid_strict() could fail and return an error without releasing the lock or dropping the reference count (fput). This improper locking (CWE-667) allows a local attacker to trigger a resource leak or deadlock. The fix moves the validation check before the lock acquisition.
Affected products
- Linux Linux Kernel 5.10.228 to 5.11, 5.15.169, 6.1.114, 6.6.58, 6.11.5, 6.12-rc4
Timeline
- 2024-11-08: disclosed
- 2024-11-08: patched
References
- https://git.kernel.org/stable/c/1ba33b327c3f88a7baee598979d73ab5b44d41cc
- https://git.kernel.org/stable/c/5f063bbf1ee6b01611c016b54e050a41506eb794
- https://git.kernel.org/stable/c/6e62807c7fbb3c758d233018caf94dfea9c65dbd
- https://git.kernel.org/stable/c/a8219446b95a859488feaade674d13f9efacfa32
- https://git.kernel.org/stable/c/b27330128eca25179637c1816d5a72d6cc408c66
- https://git.kernel.org/stable/c/c7fcfdba35abc9f39b83080c2bce398dad13a943
- https://git.kernel.org/stable/c/d005400262ddaf1ca1666bbcd1acf42fe81d57ce