CVE-2024-50032: rcu/nocb: Fix rcuog wake-up from offline softirq
In the Linux kernel, the following vulnerability has been resolved:
rcu/nocb: Fix rcuog wake-up from offline softirq
After a CPU has set itself offline and before it eventually calls rcutreereportcpudead(), there are still opportunities for callbacks to be enqueued, for example from a softirq. When that happens on NOCB, the rcuog wake-up is deferred through an IPI to an online CPU in order not to call into the scheduler and risk arming the RT-bandwidth after hrtimers have been migrated out and disabled.
But performing a synchronized IPI from a softirq is buggy as reported in the following scenario:
WARNING: CPU: 1 PID: 26 at kernel/smp.c:633 smpcallfunctionsingle Modules linked in: rcutorture torture CPU: 1 UID: 0 PID: 26 Comm: migration/1 Not tainted 6.11.0-rc1-00012-g9139f93209d1 #1 Stopper: multicpustop+0x0/0x320 <- stopcpus+0xd0/0x120 RIP: 0010:smpcallfunctionsingle <IRQ> swakeuponeonline callrcunocbwake callrcucommon ? rcutortureoneread calltimerfn runtimers runtimersoftirq handlesoftirqs irqexitrcu ? tickhandleperiodic sysvecapictimerinterrupt </IRQ>
Fix this with forcing deferred rcuog wake up through the NOCB timer when the CPU is offline. The actual wake up will happen from rcutreereportcpudead().
Other sources
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.12.25-1 - Compensating control
When the CPU is offline, force the deferred rcuog wake-up through the NOCB timer; the actual wake-up occurs from rcutree_report_cpu_dead().
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50032?
CVE-2024-50032 is rated as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-50032?
To fix CVE-2024-50032, update your Linux kernel to a version that includes the patch for this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-50032?
CVE-2024-50032 affects Linux kernel versions between 6.6.54 and 6.6.57, as well as several other specified versions.
What type of vulnerability is CVE-2024-50032?
CVE-2024-50032 is a race condition vulnerability related to the rcu/nocb subsystem in the Linux kernel.
Can CVE-2024-50032 lead to system crashes?
Yes, CVE-2024-50032 could potentially lead to system instability or crashes due to improper handling of callback enqueuing.