CVE-2024-42245: Revert "sched/fair: Make sure to try to detach at least one movable task"

Published Aug 7, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

Revert "sched/fair: Make sure to try to detach at least one movable task"

This reverts commit b0defa7ae03ecf91b8bfd10ede430cff12fcbd06.

b0defa7ae03ec changed the load balancing logic to ignore env.maxloop if all tasks examined to that point were pinned. The goal of the patch was to make it more likely to be able to detach a task buried in a long list of pinned tasks. However, this has the unfortunate side effect of creating an O(n) iteration in detachtasks(), as we now must fully iterate every task on a cpu if all or most are pinned. Since this load balance code is done with rq lock held, and often in softirq context, it is very easy to trigger hard lockups. We observed such hard lockups with a user who affined O(10k) threads to a single cpu.

When I discussed this with Vincent he initially suggested that we keep the limit on the number of tasks to detach, but increase the number of tasks we can search. However, after some back and forth on the mailing list, he recommended we instead revert the original patch, as it seems likely no one was actually getting hit by the original issue.

Affected Software

7 affected componentsFixes available
Linux Linux kernel>=6.1<6.1.100
Linux Linux kernel>=6.2<6.6.41
Linux Linux kernel>=6.7<6.9.10
debian/linux
5.10.223-15.10.234-16.1.129-16.1.135-16.12.25-16.12.27-1
debian/linux-6.1
6.1.129-1~deb11u1
Microsoft azl3 kernel 6.6.35.1-5
Microsoft azl3 kernel 6.6.43.1-7

Event History

Aug 7, 2024
CVE Published
via MITRE·03:14 PM
Data Sourced
via MITRE·03:14 PM
Description
Data Sourced
via NVD·04:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Aug 16, 2024
Data Sourced
via Microsoft·07:00 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·07:00 AM
Affected Software
Updated
via Microsoft·07:00 AM
SeverityAffected Software
Updated
via Microsoft·07:00 AM
DescriptionSeverity
Dec 15, 2024
Data Sourced
via Ubuntu·12:32 PM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2024-42245?

CVE-2024-42245 has a medium severity level due to its potential impact on load balancing in the Linux kernel.

2

How do I fix CVE-2024-42245?

To mitigate CVE-2024-42245, upgrade your Linux kernel to a version that contains the relevant fixes, such as 5.10.223-1 or 6.1.123-1.

3

Which versions of the Linux kernel are affected by CVE-2024-42245?

CVE-2024-42245 affects Linux kernel versions from 6.1 to 6.1.100, 6.2 to 6.6.41, and 6.7 to 6.9.10.

4

Is CVE-2024-42245 related to a specific commit in the Linux kernel?

Yes, CVE-2024-42245 is associated with the revert of commit b0defa7ae03ecf91b8bfd10ede430cff12fcbd06.

5

What are the implications of CVE-2024-42245 on system performance?

CVE-2024-42245 could lead to suboptimal load balancing, impacting system performance under certain workloads.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203