cve-2024-41023
Vulnerability from cvelistv5
Published
2024-07-29 14:31
Modified
2024-09-11 17:34
Severity ?
EPSS score ?
Summary
sched/deadline: Fix task_struct reference leak
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:39:56.070Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/7a54d31face626f62de415ebe77b43f76c3ffaf4"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/b58652db66c910c2245f5bee7deca41c12d707b9"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41023",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T16:24:19.073103Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T17:34:04.883Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/sched/deadline.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7a54d31face6",
"status": "affected",
"version": "feff2e65efd8",
"versionType": "git"
},
{
"lessThan": "b58652db66c9",
"status": "affected",
"version": "feff2e65efd8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/sched/deadline.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.9.*",
"status": "unaffected",
"version": "6.9.10",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.10",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/deadline: Fix task_struct reference leak\n\nDuring the execution of the following stress test with linux-rt:\n\nstress-ng --cyclic 30 --timeout 30 --minimize --quiet\n\nkmemleak frequently reported a memory leak concerning the task_struct:\n\nunreferenced object 0xffff8881305b8000 (size 16136):\n comm \"stress-ng\", pid 614, jiffies 4294883961 (age 286.412s)\n object hex dump (first 32 bytes):\n 02 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .@..............\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n debug hex dump (first 16 bytes):\n 53 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 S...............\n backtrace:\n [\u003c00000000046b6790\u003e] dup_task_struct+0x30/0x540\n [\u003c00000000c5ca0f0b\u003e] copy_process+0x3d9/0x50e0\n [\u003c00000000ced59777\u003e] kernel_clone+0xb0/0x770\n [\u003c00000000a50befdc\u003e] __do_sys_clone+0xb6/0xf0\n [\u003c000000001dbf2008\u003e] do_syscall_64+0x5d/0xf0\n [\u003c00000000552900ff\u003e] entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nThe issue occurs in start_dl_timer(), which increments the task_struct\nreference count and sets a timer. The timer callback, dl_task_timer,\nis supposed to decrement the reference count upon expiration. However,\nif enqueue_task_dl() is called before the timer expires and cancels it,\nthe reference count is not decremented, leading to the leak.\n\nThis patch fixes the reference leak by ensuring the task_struct\nreference count is properly decremented when the timer is canceled."
}
],
"providerMetadata": {
"dateUpdated": "2024-07-29T14:31:40.439Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7a54d31face626f62de415ebe77b43f76c3ffaf4"
},
{
"url": "https://git.kernel.org/stable/c/b58652db66c910c2245f5bee7deca41c12d707b9"
}
],
"title": "sched/deadline: Fix task_struct reference leak",
"x_generator": {
"engine": "bippy-c9c4e1df01b2"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-41023",
"datePublished": "2024-07-29T14:31:40.439Z",
"dateReserved": "2024-07-12T12:17:45.615Z",
"dateUpdated": "2024-09-11T17:34:04.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-41023\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-29T15:15:11.200\",\"lastModified\":\"2024-07-29T16:21:52.517\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsched/deadline: Fix task_struct reference leak\\n\\nDuring the execution of the following stress test with linux-rt:\\n\\nstress-ng --cyclic 30 --timeout 30 --minimize --quiet\\n\\nkmemleak frequently reported a memory leak concerning the task_struct:\\n\\nunreferenced object 0xffff8881305b8000 (size 16136):\\n comm \\\"stress-ng\\\", pid 614, jiffies 4294883961 (age 286.412s)\\n object hex dump (first 32 bytes):\\n 02 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .@..............\\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\\n debug hex dump (first 16 bytes):\\n 53 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 S...............\\n backtrace:\\n [\u003c00000000046b6790\u003e] dup_task_struct+0x30/0x540\\n [\u003c00000000c5ca0f0b\u003e] copy_process+0x3d9/0x50e0\\n [\u003c00000000ced59777\u003e] kernel_clone+0xb0/0x770\\n [\u003c00000000a50befdc\u003e] __do_sys_clone+0xb6/0xf0\\n [\u003c000000001dbf2008\u003e] do_syscall_64+0x5d/0xf0\\n [\u003c00000000552900ff\u003e] entry_SYSCALL_64_after_hwframe+0x6e/0x76\\n\\nThe issue occurs in start_dl_timer(), which increments the task_struct\\nreference count and sets a timer. The timer callback, dl_task_timer,\\nis supposed to decrement the reference count upon expiration. However,\\nif enqueue_task_dl() is called before the timer expires and cancels it,\\nthe reference count is not decremented, leading to the leak.\\n\\nThis patch fixes the reference leak by ensuring the task_struct\\nreference count is properly decremented when the timer is canceled.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7a54d31face626f62de415ebe77b43f76c3ffaf4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b58652db66c910c2245f5bee7deca41c12d707b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}