CVE-2024-41045 (GCVE-0-2024-41045)

Vulnerability from cvelistv5 – Published: 2024-07-29 14:32 – Updated: 2026-05-11 20:25
VLAI
Title
bpf: Defer work in bpf_timer_cancel_and_free
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Defer work in bpf_timer_cancel_and_free Currently, the same case as previous patch (two timer callbacks trying to cancel each other) can be invoked through bpf_map_update_elem as well, or more precisely, freeing map elements containing timers. Since this relies on hrtimer_cancel as well, it is prone to the same deadlock situation as the previous patch. It would be sufficient to use hrtimer_try_to_cancel to fix this problem, as the timer cannot be enqueued after async_cancel_and_free. Once async_cancel_and_free has been done, the timer must be reinitialized before it can be armed again. The callback running in parallel trying to arm the timer will fail, and freeing bpf_hrtimer without waiting is sufficient (given kfree_rcu), and bpf_timer_cb will return HRTIMER_NORESTART, preventing the timer from being rearmed again. However, there exists a UAF scenario where the callback arms the timer before entering this function, such that if cancellation fails (due to timer callback invoking this routine, or the target timer callback running concurrently). In such a case, if the timer expiration is significantly far in the future, the RCU grace period expiration happening before it will free the bpf_hrtimer state and along with it the struct hrtimer, that is enqueued. Hence, it is clear cancellation needs to occur after async_cancel_and_free, and yet it cannot be done inline due to deadlock issues. We thus modify bpf_timer_cancel_and_free to defer work to the global workqueue, adding a work_struct alongside rcu_head (both used at _different_ points of time, so can share space). Update existing code comments to reflect the new state of affairs.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b00628b1c7d595ae5b544e059c27b1f5828314b4 , < 7aa5a19279c3639ae8b758b63f05d0c616a39fa1 (git)
Affected: b00628b1c7d595ae5b544e059c27b1f5828314b4 , < a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69 (git)
Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.9.10 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:46:51.645Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7aa5a19279c3639ae8b758b63f05d0c616a39fa1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41045",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:23:00.726132Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:02.451Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/helpers.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7aa5a19279c3639ae8b758b63f05d0c616a39fa1",
              "status": "affected",
              "version": "b00628b1c7d595ae5b544e059c27b1f5828314b4",
              "versionType": "git"
            },
            {
              "lessThan": "a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69",
              "status": "affected",
              "version": "b00628b1c7d595ae5b544e059c27b1f5828314b4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/helpers.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.10",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Defer work in bpf_timer_cancel_and_free\n\nCurrently, the same case as previous patch (two timer callbacks trying\nto cancel each other) can be invoked through bpf_map_update_elem as\nwell, or more precisely, freeing map elements containing timers. Since\nthis relies on hrtimer_cancel as well, it is prone to the same deadlock\nsituation as the previous patch.\n\nIt would be sufficient to use hrtimer_try_to_cancel to fix this problem,\nas the timer cannot be enqueued after async_cancel_and_free. Once\nasync_cancel_and_free has been done, the timer must be reinitialized\nbefore it can be armed again. The callback running in parallel trying to\narm the timer will fail, and freeing bpf_hrtimer without waiting is\nsufficient (given kfree_rcu), and bpf_timer_cb will return\nHRTIMER_NORESTART, preventing the timer from being rearmed again.\n\nHowever, there exists a UAF scenario where the callback arms the timer\nbefore entering this function, such that if cancellation fails (due to\ntimer callback invoking this routine, or the target timer callback\nrunning concurrently). In such a case, if the timer expiration is\nsignificantly far in the future, the RCU grace period expiration\nhappening before it will free the bpf_hrtimer state and along with it\nthe struct hrtimer, that is enqueued.\n\nHence, it is clear cancellation needs to occur after\nasync_cancel_and_free, and yet it cannot be done inline due to deadlock\nissues. We thus modify bpf_timer_cancel_and_free to defer work to the\nglobal workqueue, adding a work_struct alongside rcu_head (both used at\n_different_ points of time, so can share space).\n\nUpdate existing code comments to reflect the new state of affairs."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:25:07.976Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7aa5a19279c3639ae8b758b63f05d0c616a39fa1"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69"
        }
      ],
      "title": "bpf: Defer work in bpf_timer_cancel_and_free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41045",
    "datePublished": "2024-07-29T14:32:02.866Z",
    "dateReserved": "2024-07-12T12:17:45.624Z",
    "dateUpdated": "2026-05-11T20:25:07.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-41045",
      "date": "2026-07-29",
      "epss": "0.00269",
      "percentile": "0.18874"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Defer work in bpf_timer_cancel_and_free\\n\\nCurrently, the same case as previous patch (two timer callbacks trying\\nto cancel each other) can be invoked through bpf_map_update_elem as\\nwell, or more precisely, freeing map elements containing timers. Since\\nthis relies on hrtimer_cancel as well, it is prone to the same deadlock\\nsituation as the previous patch.\\n\\nIt would be sufficient to use hrtimer_try_to_cancel to fix this problem,\\nas the timer cannot be enqueued after async_cancel_and_free. Once\\nasync_cancel_and_free has been done, the timer must be reinitialized\\nbefore it can be armed again. The callback running in parallel trying to\\narm the timer will fail, and freeing bpf_hrtimer without waiting is\\nsufficient (given kfree_rcu), and bpf_timer_cb will return\\nHRTIMER_NORESTART, preventing the timer from being rearmed again.\\n\\nHowever, there exists a UAF scenario where the callback arms the timer\\nbefore entering this function, such that if cancellation fails (due to\\ntimer callback invoking this routine, or the target timer callback\\nrunning concurrently). In such a case, if the timer expiration is\\nsignificantly far in the future, the RCU grace period expiration\\nhappening before it will free the bpf_hrtimer state and along with it\\nthe struct hrtimer, that is enqueued.\\n\\nHence, it is clear cancellation needs to occur after\\nasync_cancel_and_free, and yet it cannot be done inline due to deadlock\\nissues. We thus modify bpf_timer_cancel_and_free to defer work to the\\nglobal workqueue, adding a work_struct alongside rcu_head (both used at\\n_different_ points of time, so can share space).\\n\\nUpdate existing code comments to reflect the new state of affairs.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Aplazar el trabajo en bpf_timer_cancel_and_free Actualmente, el mismo caso del parche anterior (dos devoluciones de llamada de temporizador que intentan cancelarse entre s\\u00ed) tambi\\u00e9n se puede invocar a trav\\u00e9s de bpf_map_update_elem, o m\\u00e1s precisamente, liberando mapa elementos que contienen temporizadores. Dado que esto tambi\\u00e9n depende de hrtimer_cancel, es propenso a la misma situaci\\u00f3n de punto muerto que el parche anterior. Ser\\u00eda suficiente usar hrtimer_try_to_cancel para solucionar este problema, ya que el temporizador no se puede poner en cola despu\\u00e9s de async_cancel_and_free. Una vez que se haya realizado async_cancel_and_free, el temporizador debe reinicializarse antes de poder armarse nuevamente. La devoluci\\u00f3n de llamada que se ejecuta en paralelo al intentar armar el temporizador fallar\\u00e1, y liberar bpf_hrtimer sin esperar es suficiente (dado kfree_rcu), y bpf_timer_cb devolver\\u00e1 HRTIMER_NORESTART, evitando que el temporizador se rearme nuevamente. Sin embargo, existe un escenario UAF en el que la devoluci\\u00f3n de llamada arma el temporizador antes de ingresar a esta funci\\u00f3n, de modo que si la cancelaci\\u00f3n falla (debido a que la devoluci\\u00f3n de llamada del temporizador invoca esta rutina o la devoluci\\u00f3n de llamada del temporizador de destino se ejecuta simult\\u00e1neamente). En tal caso, si la expiraci\\u00f3n del temporizador est\\u00e1 significativamente lejos en el futuro, la expiraci\\u00f3n del per\\u00edodo de gracia de RCU que ocurra antes liberar\\u00e1 el estado bpf_hrtimer y junto con \\u00e9l la estructura hrtimer, que est\\u00e1 en cola. Por lo tanto, est\\u00e1 claro que la cancelaci\\u00f3n debe ocurrir despu\\u00e9s de async_cancel_and_free y, sin embargo, no se puede realizar en l\\u00ednea debido a problemas de interbloqueo. Por lo tanto, modificamos bpf_timer_cancel_and_free para diferir el trabajo a la cola de trabajo global, agregando un work_struct junto con rcu_head (ambos usados en _diferentes_ puntos de tiempo, por lo que pueden compartir espacio). Actualice los comentarios del c\\u00f3digo existente para reflejar la nueva situaci\\u00f3n.\"}]",
      "id": "CVE-2024-41045",
      "lastModified": "2024-11-21T09:32:07.857",
      "published": "2024-07-29T15:15:12.873",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/7aa5a19279c3639ae8b758b63f05d0c616a39fa1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7aa5a19279c3639ae8b758b63f05d0c616a39fa1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:46:39.000Z",
      "cve": "CVE-2024-41045",
      "id": "msrc_CVE-2024-41045",
      "initial_release_date": "2024-07-01T07:00:00.000Z",
      "product_status:known_affected": "19",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bpf: Defer work in bpf_timer_cancel_and_free",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-41045.json",
      "version": "14"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-41045\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-29T15:15:12.873\",\"lastModified\":\"2026-06-17T07:47:09.500\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Defer work in bpf_timer_cancel_and_free\\n\\nCurrently, the same case as previous patch (two timer callbacks trying\\nto cancel each other) can be invoked through bpf_map_update_elem as\\nwell, or more precisely, freeing map elements containing timers. Since\\nthis relies on hrtimer_cancel as well, it is prone to the same deadlock\\nsituation as the previous patch.\\n\\nIt would be sufficient to use hrtimer_try_to_cancel to fix this problem,\\nas the timer cannot be enqueued after async_cancel_and_free. Once\\nasync_cancel_and_free has been done, the timer must be reinitialized\\nbefore it can be armed again. The callback running in parallel trying to\\narm the timer will fail, and freeing bpf_hrtimer without waiting is\\nsufficient (given kfree_rcu), and bpf_timer_cb will return\\nHRTIMER_NORESTART, preventing the timer from being rearmed again.\\n\\nHowever, there exists a UAF scenario where the callback arms the timer\\nbefore entering this function, such that if cancellation fails (due to\\ntimer callback invoking this routine, or the target timer callback\\nrunning concurrently). In such a case, if the timer expiration is\\nsignificantly far in the future, the RCU grace period expiration\\nhappening before it will free the bpf_hrtimer state and along with it\\nthe struct hrtimer, that is enqueued.\\n\\nHence, it is clear cancellation needs to occur after\\nasync_cancel_and_free, and yet it cannot be done inline due to deadlock\\nissues. We thus modify bpf_timer_cancel_and_free to defer work to the\\nglobal workqueue, adding a work_struct alongside rcu_head (both used at\\n_different_ points of time, so can share space).\\n\\nUpdate existing code comments to reflect the new state of affairs.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Aplazar el trabajo en bpf_timer_cancel_and_free Actualmente, el mismo caso del parche anterior (dos devoluciones de llamada de temporizador que intentan cancelarse entre s\u00ed) tambi\u00e9n se puede invocar a trav\u00e9s de bpf_map_update_elem, o m\u00e1s precisamente, liberando mapa elementos que contienen temporizadores. Dado que esto tambi\u00e9n depende de hrtimer_cancel, es propenso a la misma situaci\u00f3n de punto muerto que el parche anterior. Ser\u00eda suficiente usar hrtimer_try_to_cancel para solucionar este problema, ya que el temporizador no se puede poner en cola despu\u00e9s de async_cancel_and_free. Una vez que se haya realizado async_cancel_and_free, el temporizador debe reinicializarse antes de poder armarse nuevamente. La devoluci\u00f3n de llamada que se ejecuta en paralelo al intentar armar el temporizador fallar\u00e1, y liberar bpf_hrtimer sin esperar es suficiente (dado kfree_rcu), y bpf_timer_cb devolver\u00e1 HRTIMER_NORESTART, evitando que el temporizador se rearme nuevamente. Sin embargo, existe un escenario UAF en el que la devoluci\u00f3n de llamada arma el temporizador antes de ingresar a esta funci\u00f3n, de modo que si la cancelaci\u00f3n falla (debido a que la devoluci\u00f3n de llamada del temporizador invoca esta rutina o la devoluci\u00f3n de llamada del temporizador de destino se ejecuta simult\u00e1neamente). En tal caso, si la expiraci\u00f3n del temporizador est\u00e1 significativamente lejos en el futuro, la expiraci\u00f3n del per\u00edodo de gracia de RCU que ocurra antes liberar\u00e1 el estado bpf_hrtimer y junto con \u00e9l la estructura hrtimer, que est\u00e1 en cola. Por lo tanto, est\u00e1 claro que la cancelaci\u00f3n debe ocurrir despu\u00e9s de async_cancel_and_free y, sin embargo, no se puede realizar en l\u00ednea debido a problemas de interbloqueo. Por lo tanto, modificamos bpf_timer_cancel_and_free para diferir el trabajo a la cola de trabajo global, agregando un work_struct junto con rcu_head (ambos usados en _diferentes_ puntos de tiempo, por lo que pueden compartir espacio). Actualice los comentarios del c\u00f3digo existente para reflejar la nueva situaci\u00f3n.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/bpf/helpers.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b00628b1c7d595ae5b544e059c27b1f5828314b4\",\"lessThan\":\"7aa5a19279c3639ae8b758b63f05d0c616a39fa1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b00628b1c7d595ae5b544e059c27b1f5828314b4\",\"lessThan\":\"a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/bpf/helpers.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.10\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:23:00.726132Z\",\"id\":\"CVE-2024-41045\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"6.9.10\",\"matchCriteriaId\":\"C89C12B4-1B68-4A90-AE7B-1DBF780ABB17\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3173713D-909A-4DD3-9DD4-1E171EB057EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"79F18AFA-40F7-43F0-BA30-7BDB65F918B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD973AA4-A789-49BD-8D57-B2846935D3C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8F3E9E0C-AC3E-4967-AF80-6483E8AB0078\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"11AF4CB9-F697-4EA4-8903-8F9417EFDA8E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7aa5a19279c3639ae8b758b63f05d0c616a39fa1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7aa5a19279c3639ae8b758b63f05d0c616a39fa1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-01-13T22:56:58+00:00",
      "cve": "CVE-2024-41045",
      "id": "CVE-2024-41045",
      "initial_release_date": "2024-07-29T00:00:00+00:00",
      "product_status:known_affected": "136",
      "product_status:known_not_affected": "62",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Defer work in bpf_timer_cancel_and_free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-41045.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-23T02:03:09Z",
      "cve": "CVE-2024-41045",
      "id": "CVE-2024-41045",
      "initial_release_date": "2024-08-06T02:01:50Z",
      "product_status:known_affected": "340",
      "product_status:known_not_affected": "223",
      "product_status:recommended": "648",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-41045",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-41045.json",
      "version": "68"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7aa5a19279c3639ae8b758b63f05d0c616a39fa1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:46:51.645Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41045\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:23:00.726132Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:20.313Z\"}}], \"cna\": {\"title\": \"bpf: Defer work in bpf_timer_cancel_and_free\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b00628b1c7d595ae5b544e059c27b1f5828314b4\", \"lessThan\": \"7aa5a19279c3639ae8b758b63f05d0c616a39fa1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b00628b1c7d595ae5b544e059c27b1f5828314b4\", \"lessThan\": \"a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/bpf/helpers.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.9.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/bpf/helpers.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7aa5a19279c3639ae8b758b63f05d0c616a39fa1\"}, {\"url\": \"https://git.kernel.org/stable/c/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Defer work in bpf_timer_cancel_and_free\\n\\nCurrently, the same case as previous patch (two timer callbacks trying\\nto cancel each other) can be invoked through bpf_map_update_elem as\\nwell, or more precisely, freeing map elements containing timers. Since\\nthis relies on hrtimer_cancel as well, it is prone to the same deadlock\\nsituation as the previous patch.\\n\\nIt would be sufficient to use hrtimer_try_to_cancel to fix this problem,\\nas the timer cannot be enqueued after async_cancel_and_free. Once\\nasync_cancel_and_free has been done, the timer must be reinitialized\\nbefore it can be armed again. The callback running in parallel trying to\\narm the timer will fail, and freeing bpf_hrtimer without waiting is\\nsufficient (given kfree_rcu), and bpf_timer_cb will return\\nHRTIMER_NORESTART, preventing the timer from being rearmed again.\\n\\nHowever, there exists a UAF scenario where the callback arms the timer\\nbefore entering this function, such that if cancellation fails (due to\\ntimer callback invoking this routine, or the target timer callback\\nrunning concurrently). In such a case, if the timer expiration is\\nsignificantly far in the future, the RCU grace period expiration\\nhappening before it will free the bpf_hrtimer state and along with it\\nthe struct hrtimer, that is enqueued.\\n\\nHence, it is clear cancellation needs to occur after\\nasync_cancel_and_free, and yet it cannot be done inline due to deadlock\\nissues. We thus modify bpf_timer_cancel_and_free to defer work to the\\nglobal workqueue, adding a work_struct alongside rcu_head (both used at\\n_different_ points of time, so can share space).\\n\\nUpdate existing code comments to reflect the new state of affairs.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:10:49.027Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-41045\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:10:49.027Z\", \"dateReserved\": \"2024-07-12T12:17:45.624Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-29T14:32:02.866Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.