cve-2024-41023
Vulnerability from cvelistv5
Published
2024-07-29 14:31
Modified
2024-11-05 09:35
Severity ?
Summary
sched/deadline: Fix task_struct reference leak
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7a54d31face626f62de415ebe77b43f76c3ffaf4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b58652db66c910c2245f5bee7deca41c12d707b9
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/7a54d31face626f62de415ebe77b43f76c3ffaf4
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/b58652db66c910c2245f5bee7deca41c12d707b9
Impacted products
Vendor Product Version
Linux Linux Version: 5.10
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:39:56.070Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7a54d31face626f62de415ebe77b43f76c3ffaf4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b58652db66c910c2245f5bee7deca41c12d707b9"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41023",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:24:19.073103Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:04.883Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/deadline.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7a54d31face6",
              "status": "affected",
              "version": "feff2e65efd8",
              "versionType": "git"
            },
            {
              "lessThan": "b58652db66c9",
              "status": "affected",
              "version": "feff2e65efd8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/deadline.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/deadline: Fix task_struct reference leak\n\nDuring the execution of the following stress test with linux-rt:\n\nstress-ng --cyclic 30 --timeout 30 --minimize --quiet\n\nkmemleak frequently reported a memory leak concerning the task_struct:\n\nunreferenced object 0xffff8881305b8000 (size 16136):\n  comm \"stress-ng\", pid 614, jiffies 4294883961 (age 286.412s)\n  object hex dump (first 32 bytes):\n    02 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00  .@..............\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  debug hex dump (first 16 bytes):\n    53 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00  S...............\n  backtrace:\n    [\u003c00000000046b6790\u003e] dup_task_struct+0x30/0x540\n    [\u003c00000000c5ca0f0b\u003e] copy_process+0x3d9/0x50e0\n    [\u003c00000000ced59777\u003e] kernel_clone+0xb0/0x770\n    [\u003c00000000a50befdc\u003e] __do_sys_clone+0xb6/0xf0\n    [\u003c000000001dbf2008\u003e] do_syscall_64+0x5d/0xf0\n    [\u003c00000000552900ff\u003e] entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nThe issue occurs in start_dl_timer(), which increments the task_struct\nreference count and sets a timer. The timer callback, dl_task_timer,\nis supposed to decrement the reference count upon expiration. However,\nif enqueue_task_dl() is called before the timer expires and cancels it,\nthe reference count is not decremented, leading to the leak.\n\nThis patch fixes the reference leak by ensuring the task_struct\nreference count is properly decremented when the timer is canceled."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-05T09:35:10.815Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7a54d31face626f62de415ebe77b43f76c3ffaf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b58652db66c910c2245f5bee7deca41c12d707b9"
        }
      ],
      "title": "sched/deadline: Fix task_struct reference leak",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41023",
    "datePublished": "2024-07-29T14:31:40.439Z",
    "dateReserved": "2024-07-12T12:17:45.615Z",
    "dateUpdated": "2024-11-05T09:35:10.815Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-41023\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-29T15:15:11.200\",\"lastModified\":\"2024-11-21T09:32:05.223\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsched/deadline: Fix task_struct reference leak\\n\\nDuring the execution of the following stress test with linux-rt:\\n\\nstress-ng --cyclic 30 --timeout 30 --minimize --quiet\\n\\nkmemleak frequently reported a memory leak concerning the task_struct:\\n\\nunreferenced object 0xffff8881305b8000 (size 16136):\\n  comm \\\"stress-ng\\\", pid 614, jiffies 4294883961 (age 286.412s)\\n  object hex dump (first 32 bytes):\\n    02 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00  .@..............\\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\\n  debug hex dump (first 16 bytes):\\n    53 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00  S...............\\n  backtrace:\\n    [\u003c00000000046b6790\u003e] dup_task_struct+0x30/0x540\\n    [\u003c00000000c5ca0f0b\u003e] copy_process+0x3d9/0x50e0\\n    [\u003c00000000ced59777\u003e] kernel_clone+0xb0/0x770\\n    [\u003c00000000a50befdc\u003e] __do_sys_clone+0xb6/0xf0\\n    [\u003c000000001dbf2008\u003e] do_syscall_64+0x5d/0xf0\\n    [\u003c00000000552900ff\u003e] entry_SYSCALL_64_after_hwframe+0x6e/0x76\\n\\nThe issue occurs in start_dl_timer(), which increments the task_struct\\nreference count and sets a timer. The timer callback, dl_task_timer,\\nis supposed to decrement the reference count upon expiration. However,\\nif enqueue_task_dl() is called before the timer expires and cancels it,\\nthe reference count is not decremented, leading to the leak.\\n\\nThis patch fixes the reference leak by ensuring the task_struct\\nreference count is properly decremented when the timer is canceled.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: sched/deadline: Reparar fuga de referencia de task_struct Durante la ejecuci\u00f3n de la siguiente prueba de estr\u00e9s con linux-rt: estr\u00e9s-ng --ciclic 30 --timeout 30 --minimize --quiet kmemleak inform\u00f3 con frecuencia una p\u00e9rdida de memoria relacionada con task_struct: objeto sin referencia 0xffff8881305b8000 (tama\u00f1o 16136): comm \\\"stress-ng\\\", pid 614, jiffies 4294883961 (edad 286.412 s) volcado hexadecimal de objeto (primeros 32 bytes): 02 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .@.............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ volcado hexadecimal de depuraci\u00f3n (primeros 16 bytes): 53 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 S............... rastreo inverso : [\u0026lt;00000000046b6790\u0026gt;] dup_task_struct+0x30/0x540 [\u0026lt;00000000c5ca0f0b\u0026gt;] copy_process+0x3d9/0x50e0 [\u0026lt;00000000ced59777\u0026gt;] kernel_clone+0xb0/0x770 [\u0026lt;00000000a50befd c\u0026gt;] __do_sys_clone+0xb6/0xf0 [\u0026lt;000000001dbf2008\u0026gt;] do_syscall_64+0x5d/ 0xf0 [\u0026lt;00000000552900ff\u0026gt;] Entry_SYSCALL_64_after_hwframe+0x6e/0x76 El problema ocurre en start_dl_timer(), que incrementa el recuento de referencias de task_struct y establece un temporizador. Se supone que la devoluci\u00f3n de llamada del temporizador, dl_task_timer, disminuye el recuento de referencia al expirar. Sin embargo, si se llama a enqueue_task_dl() antes de que expire el temporizador y lo cancela, el recuento de referencias no disminuye, lo que provoca la fuga. Este parche corrige la fuga de referencia al garantizar que el recuento de referencias de task_struct disminuya correctamente cuando se cancela el temporizador.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7a54d31face626f62de415ebe77b43f76c3ffaf4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b58652db66c910c2245f5bee7deca41c12d707b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7a54d31face626f62de415ebe77b43f76c3ffaf4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/b58652db66c910c2245f5bee7deca41c12d707b9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.