NVD Vulnerability Detail
Search Exploit, PoC
CVE-2024-53042
Summary

In the Linux kernel, the following vulnerability has been resolved:

ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow()

There are code paths from which the function is called without holding
the RCU read lock, resulting in a suspicious RCU usage warning [1].

Fix by using l3mdev_master_upper_ifindex_by_index() which will acquire
the RCU read lock before calling
l3mdev_master_upper_ifindex_by_index_rcu().

[1]
WARNING: suspicious RCU usage
6.12.0-rc3-custom-gac8f72681cf2 #141 Not tainted
-----------------------------
net/core/dev.c:876 RCU-list traversed in non-reader section!!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
1 lock held by ip/361:
#0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60

stack backtrace:
CPU: 3 UID: 0 PID: 361 Comm: ip Not tainted 6.12.0-rc3-custom-gac8f72681cf2 #141
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Call Trace:
<TASK>
dump_stack_lvl+0xba/0x110
lockdep_rcu_suspicious.cold+0x4f/0xd6
dev_get_by_index_rcu+0x1d3/0x210
l3mdev_master_upper_ifindex_by_index_rcu+0x2b/0xf0
ip_tunnel_bind_dev+0x72f/0xa00
ip_tunnel_newlink+0x368/0x7a0
ipgre_newlink+0x14c/0x170
__rtnl_newlink+0x1173/0x19c0
rtnl_newlink+0x6c/0xa0
rtnetlink_rcv_msg+0x3cc/0xf60
netlink_rcv_skb+0x171/0x450
netlink_unicast+0x539/0x7f0
netlink_sendmsg+0x8c1/0xd80
____sys_sendmsg+0x8f9/0xc20
___sys_sendmsg+0x197/0x1e0
__sys_sendmsg+0x122/0x1f0
do_syscall_64+0xbb/0x1d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Publication Date Nov. 20, 2024, 3:15 a.m.
Registration Date Nov. 20, 2024, 5 a.m.
Last Update Nov. 20, 2024, 3:15 a.m.
Related information, measures and tools
Common Vulnerabilities List

JVN Vulnerability Information
Linux の Linux Kernel における脆弱性
Title Linux の Linux Kernel における脆弱性
Summary

Linux の Linux Kernel には、不特定の脆弱性が存在します。

Possible impacts サービス運用妨害 (DoS) 状態にされる可能性があります。 
Solution

ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。

Publication Date Oct. 29, 2024, midnight
Registration Date Nov. 29, 2024, 12:28 p.m.
Last Update Nov. 29, 2024, 12:28 p.m.
Affected System
Linux
Linux Kernel 5.10.227 以上 5.10.229 未満
Linux Kernel 5.15.168 以上 5.15.171 未満
Linux Kernel 5.18 以上 6.1.116 未満
Linux Kernel 6.12
Linux Kernel 6.2 以上 6.6.60 未満
Linux Kernel 6.7 以上 6.11.7 未満
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
Change Log
No Changed Details Date of change
1 [2024年11月29日]
  掲載
Nov. 29, 2024, 12:28 p.m.