CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix missing locking causing hanging calls
If a call gets aborted (e.g. because kafs saw a signal) between it being queued for connection and the I/O thread picking up the call, the abort will be prioritised over the connection and it will be removed from local->newclientcalls by rxrpcdisconnectclientcall() without a lock being held. This may cause other calls on the list to disappear if a race occurs.
Fix this by taking the clientcalllock when removing a call from whatever list its ->waitlink happens to be on.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix missing locking causing hanging calls
If a call gets aborted (e.g. because kafs saw a signal) between it being queued for connection and the I/O thread picking up the call, the abort will be prioritised over the connection and it will be removed from local-newclientcalls by rxrpcdisconnectclientcall() without a lock being held. This may cause other calls on the list to disappear if a race occurs.
Fix this by taking the clientcalllock when removing a call from whatever list its -waitlink happens to be on.
— IBM
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50294?
CVE-2024-50294 has been classified as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-50294?
To resolve CVE-2024-50294, update your Linux kernel to one of the patched versions 5.10.223-1, 5.10.234-1, 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.17-1.
What are the consequences of not addressing CVE-2024-50294?
Failure to address CVE-2024-50294 may result in potential hanging calls and unstable kernel behavior in affected systems.
Which versions of the Linux kernel are affected by CVE-2024-50294?
CVE-2024-50294 affects specific versions of the Linux kernel including 5.10.223-1, 5.10.234-1, 6.1.123-1, 6.1.128-1, 6.12.12-1, and 6.12.17-1.
Is CVE-2024-50294 specific to any Linux distributions?
CVE-2024-50294 is noted specifically in the Debian distribution of the Linux kernel.