CVE-2024-50210: posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
In the Linux kernel, the following vulnerability has been resolved:
posix-clock: posix-clock: Fix unbalanced locking in pcclocksettime()
If getclockdesc() succeeds, it calls fget() for the clockid's fd, and get the clk->rwsem read lock, so the error path should release the lock to make the lock balance and fput the clockid's fd to make the refcount balance and release the fd related resource.
However the below commit left the error path locked behind resulting in unbalanced locking. Check timespec64validstrict() before getclockdesc() to fix it, because the "ts" is not changed after that.
[pabeni@redhat.com: fixed commit message typo]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50210?
CVE-2024-50210 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-50210?
To remediate CVE-2024-50210, update your Linux kernel to a version that includes the fix.
Which Linux kernel versions are affected by CVE-2024-50210?
CVE-2024-50210 affects Linux kernel versions between 5.10.228 and 5.11, as well as specific versions 5.15.169, 6.1.114, 6.6.58, 6.11.5, and 6.12-rc4.
How can CVE-2024-50210 impact system security?
CVE-2024-50210 could potentially lead to unbalanced locking issues, which may affect the stability and security of the affected system.
Is there a public reference for CVE-2024-50210?
Yes, CVE-2024-50210 has been documented in public repositories related to the Linux kernel security updates.