CVE-2024-50060: io_uring: check if we need to reschedule during overflow flush
In the Linux kernel, the following vulnerability has been resolved:
iouring: check if we need to reschedule during overflow flush
In terms of normal application usage, this list will always be empty. And if an application does overflow a bit, it'll have a few entries. However, nothing obviously prevents syzbot from running a test case that generates a ton of overflow entries, and then flushing them can take quite a while.
Check for needing to reschedule while flushing, and drop our locks and do so if necessary. There's no state to maintain here as overflows always prune from head-of-list, hence it's fine to drop and reacquire the locks at the end of the loop.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.170-3Fixed in 6.1.174-1Fixed in 6.12.86-1Fixed in 6.12.90-2Fixed in 7.0.10-1Fixed in 7.0.12-2 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.174-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50060?
CVE-2024-50060 has been rated with a moderate severity level due to its potential impact on system stability.
How do I fix CVE-2024-50060?
To fix CVE-2024-50060, you should update the Linux kernel to a version newer than 6.1.113 or 6.6.57 or 6.11.4.
What systems are affected by CVE-2024-50060?
CVE-2024-50060 affects various versions of the Linux kernel, specifically those between 6.1.0 to 6.1.113, 6.6.0 to 6.6.57, and 6.11.0 to 6.11.4.
What type of vulnerability is CVE-2024-50060?
CVE-2024-50060 is classified as a reliability vulnerability related to the io_uring implementation in the Linux kernel.
Is there a workaround for CVE-2024-50060?
There are no specific workarounds recommended for CVE-2024-50060; updating the kernel is the preferred action.