CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
In the Linux kernel, the following vulnerability has been resolved:
ipv4: iptunnel: Fix suspicious RCU usage warning in iptunnelfind()
The per-netns IP tunnel hash table is protected by the RTNL mutex and iptunnelfind() is only called from the control path where the mutex is taken.
Add a lockdep expression to hlistforeachentryrcu() in iptunnelfind() in order to validate that the mutex is held and to silence the suspicious RCU usage warning [1].
[1] WARNING: suspicious RCU usage 6.12.0-rc3-custom-gd95d9a31aceb #139 Not tainted ----------------------------- net/ipv4/iptunnel.c:221 RCU-list traversed in non-reader section!!
other info that might help us debug this:
rcuscheduleractive = 2, debuglocks = 1 1 lock held by ip/362: #0: ffffffff86fc7cb0 (rtnlmutex){+.+.}-{3:3}, at: rtnetlinkrcvmsg+0x377/0xf60
stack backtrace: CPU: 12 UID: 0 PID: 362 Comm: ip Not tainted 6.12.0-rc3-custom-gd95d9a31aceb #139 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dumpstacklvl+0xba/0x110 lockdeprcususpicious.cold+0x4f/0xd6 iptunnelfind+0x435/0x4d0 iptunnelnewlink+0x517/0x7a0 ipgrenewlink+0x14c/0x170 rtnlnewlink+0x1173/0x19c0 rtnlnewlink+0x6c/0xa0 rtnetlinkrcvmsg+0x3cc/0xf60 netlinkrcvskb+0x171/0x450 netlinkunicast+0x539/0x7f0 netlinksendmsg+0x8c1/0xd80 syssendmsg+0x8f9/0xc20 syssendmsg+0x197/0x1e0 syssendmsg+0x122/0x1f0 dosyscall64+0xbb/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.251-5Fixed in 6.1.170-3Fixed in 6.1.172-1Fixed in 6.12.86-1Fixed in 6.12.88-1Fixed in 7.0.7-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.172-1~deb11u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.179.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.76.1-1 - Configuration
In ip_tunnel_find() (net/ipv4/ip_tunnel.c at the hlist_for_each_entry_rcu() usage), add the lockdep expression to validate that the RTNL mutex is held; this is intended to silence the 'WARNING: suspicious RCU usage' (RCU-list traversed in non-reader section) triggered at net/ipv4/ip_tunnel.c:221.
Linux kernel (net/ipv4/ip_tunnel.c, function ip_tunnel_find()) Add lockdep expression to hlist_for_each_entry_rcu() = enabled (add lockdep validation that RTNL mutex is held)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50304?
CVE-2024-50304 has a moderate severity rating due to the potential impact on system stability.
How do I fix CVE-2024-50304?
To address CVE-2024-50304, update your Linux kernel to a version higher than 6.11.7 or apply the patches from the kernel repositories.
Which Linux kernel versions are affected by CVE-2024-50304?
CVE-2024-50304 affects Linux kernel versions from 3.10.12 up to 6.11.7, as well as versions 6.12-rc1 to 6.12-rc6.
What types of systems are impacted by CVE-2024-50304?
Systems running the affected versions of the Linux kernel, particularly those utilizing IP tunnel features, are impacted by CVE-2024-50304.
Is there a known exploit for CVE-2024-50304?
As of now, there is no publicly available exploit for CVE-2024-50304.