Most recent entries from all

CVE-2024-42239 — bpf: Fail bpf_timer_cancel when callback is being cancelled

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fail bpf_timer_cancel when callback is being cancelled

Given a schedule:

timer1 cb timer2 cb

bpf_timer_cancel(timer2); bpf_timer_cancel(timer1);

Both bpf_timer_cancel calls would wait for the other callback to finish executing, introducing a lockup.

Add an atomic_t count named 'cancelling' in bpf_hrtimer. This keeps track of all in-flight cancellation requests for a given BPF timer. Whenever cancelling a BPF timer, we must check if we have outstanding cancellation requests, and if so, we must fail the operation with an error (-EDEADLK) since cancellation is synchronous and waits for the callback to finish executing. This implies that we can enter a deadlock situation involving two or more timer callbacks executing in parallel and attempting to cancel one another.

Note that we avoid incrementing the cancelling counter for the target timer (the one being cancelled) if bpf_timer_cancel is not invoked from a callback, to avoid spurious errors. The whole point of detecting cur->cancelling and returning -EDEADLK is to not enter a busy wait loop (which may or may not lead to a lockup). This does not apply in case the caller is in a non-callback context, the other side can continue to cancel as it sees fit without running into errors.

Background on prior attempts:

Earlier versions of this patch used a bool 'cancelling' bit and used the following pattern under timer->lock to publish cancellation statu…

USN-7089-1 — linux, linux-gcp-6.8, linux-hwe-6.8 vulnerabilities

Affected: Ubuntu:22.04:LTS: linux-gcp-6.8, Ubuntu:22.04:LTS: linux-hwe-6.8, Ubuntu:24.04:LTS: linux

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - MIPS architecture; - PA-RISC architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - x86 architecture; - Cryptographic API; - Serial ATA and Parallel ATA drivers; - Null block device driver; - Bluetooth drivers; - Cdrom driver; - Clock framework and drivers; - Hardware crypto device drivers; - CXL (Compute Express Link) drivers; - Cirrus firmware drivers; - GPIO subsystem; - GPU drivers; - I2C subsystem; - IIO subsystem; - InfiniBand drivers; - ISDN/mISDN subsystem; - LED subsystem; - Multiple devices driver; - Media drivers; - Fastrpc Driver; - Network drivers; - Microsoft Azure Network Adapter (MANA) driver; - Near Field Communication (NFC) drivers; - NVME drivers; - NVMEM (Non Volatile Memory) drivers; - PCI subsystem; - Pin controllers subsystem; - x86 platform drivers; - S/390 drivers; - SCSI drivers; - Thermal drivers; - TTY drivers; - UFS subsystem; - USB DSL drivers; - USB core drivers; - DesignWare USB3 driver; - USB Gadget dr…