GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GHSA-5M9V-H8PG-4XV6

Vulnerability from github – Published: 2024-10-21 21:30 – Updated: 2024-10-25 18:30
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

rcu/nocb: Fix rcuog wake-up from offline softirq

After a CPU has set itself offline and before it eventually calls rcutree_report_cpu_dead(), there are still opportunities for callbacks to be enqueued, for example from a softirq. When that happens on NOCB, the rcuog wake-up is deferred through an IPI to an online CPU in order not to call into the scheduler and risk arming the RT-bandwidth after hrtimers have been migrated out and disabled.

But performing a synchronized IPI from a softirq is buggy as reported in the following scenario:

    WARNING: CPU: 1 PID: 26 at kernel/smp.c:633 smp_call_function_single
    Modules linked in: rcutorture torture
    CPU: 1 UID: 0 PID: 26 Comm: migration/1 Not tainted 6.11.0-rc1-00012-g9139f93209d1 #1
    Stopper: multi_cpu_stop+0x0/0x320 <- __stop_cpus+0xd0/0x120
    RIP: 0010:smp_call_function_single
    <IRQ>
    swake_up_one_online
    __call_rcu_nocb_wake
    __call_rcu_common
    ? rcu_torture_one_read
    call_timer_fn
    __run_timers
    run_timer_softirq
    handle_softirqs
    irq_exit_rcu
    ? tick_handle_periodic
    sysvec_apic_timer_interrupt
    </IRQ>

Fix this with forcing deferred rcuog wake up through the NOCB timer when the CPU is offline. The actual wake up will happen from rcutree_report_cpu_dead().

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-50032"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-21T20:15:16Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu/nocb: Fix rcuog wake-up from offline softirq\n\nAfter a CPU has set itself offline and before it eventually calls\nrcutree_report_cpu_dead(), there are still opportunities for callbacks\nto be enqueued, for example from a softirq. When that happens on NOCB,\nthe rcuog wake-up is deferred through an IPI to an online CPU in order\nnot to call into the scheduler and risk arming the RT-bandwidth after\nhrtimers have been migrated out and disabled.\n\nBut performing a synchronized IPI from a softirq is buggy as reported in\nthe following scenario:\n\n        WARNING: CPU: 1 PID: 26 at kernel/smp.c:633 smp_call_function_single\n        Modules linked in: rcutorture torture\n        CPU: 1 UID: 0 PID: 26 Comm: migration/1 Not tainted 6.11.0-rc1-00012-g9139f93209d1 #1\n        Stopper: multi_cpu_stop+0x0/0x320 \u003c- __stop_cpus+0xd0/0x120\n        RIP: 0010:smp_call_function_single\n        \u003cIRQ\u003e\n        swake_up_one_online\n        __call_rcu_nocb_wake\n        __call_rcu_common\n        ? rcu_torture_one_read\n        call_timer_fn\n        __run_timers\n        run_timer_softirq\n        handle_softirqs\n        irq_exit_rcu\n        ? tick_handle_periodic\n        sysvec_apic_timer_interrupt\n        \u003c/IRQ\u003e\n\nFix this with forcing deferred rcuog wake up through the NOCB timer when\nthe CPU is offline. The actual wake up will happen from\nrcutree_report_cpu_dead().",
  "id": "GHSA-5m9v-h8pg-4xv6",
  "modified": "2024-10-25T18:30:48Z",
  "published": "2024-10-21T21:30:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50032"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/84a5feebba10354c683983f5f1372a144225e4c2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e66b1e01f2eb3209d08122572f41f7838b79540d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f7345ccc62a4b880cf76458db5f320725f28e400"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.