In the Linux kernel, the following vulnerability has been resolved:
netfilter: IDLETIMER: Fix for possible ABBA deadlock
Deletion of the last rule referencing a given idletimer may happen at the same time as a read of its file in sysfs:
| ====================================================== | WARNING: possible circular locking dependency detected | 6.12.0-rc7-01692-g5e9a28f41134-dirty #594 Not tainted | ------------------------------------------------------ | iptables/3303 is trying to acquire lock: | ffff8881057e04b8 (kn->active#48){++++}-{0:0}, at: _kernfsremove+0x20 | | but task is already holding lock: | ffffffffa0249068 (listmutex){+.+.}-{3:3}, at: idletimertgdestroyv] | | which lock already depends on the new lock.
A simple reproducer is:
| #!/bin/bash | | while true; do | iptables -A INPUT -i foo -j IDLETIMER --timeout 10 --label "testme" | iptables -D INPUT -i foo -j IDLETIMER --timeout 10 --label "testme" | done & | while true; do | cat /sys/class/xt_idletimer/timers/testme >/dev/null | done
Avoid this by freeing list_mutex right after deleting the element from the list, then continuing with the teardown.
[
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/netfilter/xt_IDLETIMER.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f36b01994d68ffc253c8296e2228dfe6e6431c03",
"digest": {
"line_hashes": [
"191292465186373328108349890101652017125",
"24718815305528987358180211317025950124",
"159333819083494293078100298068245213528",
"216337572043005150711004826823222433873",
"141144581277918121305214269520207533366",
"31156780488923047230871912423786027754",
"278938116526650266967693570686238382297",
"157484689866173930156323902599776104174",
"50183242859006217258426224117962590256",
"129708965212540956026086486234009295731",
"262079640943611400256567604240151764740",
"158905524705048011078112051294065354908",
"192038278928248819406676953417705966033",
"265924159784930637094980800821121177999",
"325259428050311468869444936254290685218",
"262927707232518430711326921413082548580",
"276957376572856840967065792441612425356",
"24718815305528987358180211317025950124",
"159333819083494293078100298068245213528",
"91544720124194054782042781026689759529",
"283720839007257506079375947034495143279",
"159390340228775498735336697404132273719",
"261266485191573520789603929647385067319",
"42138517887928295641651549252801055147",
"104487007999956303201582382982441487045",
"148147400228544997725469749435109108487",
"99683643862057473127759699311565522755",
"157484689866173930156323902599776104174",
"50183242859006217258426224117962590256",
"129708965212540956026086486234009295731",
"262079640943611400256567604240151764740",
"158905524705048011078112051294065354908",
"192038278928248819406676953417705966033",
"265924159784930637094980800821121177999",
"110057616750513531840362628014791626330",
"115230448519603238257397079055496759916"
],
"threshold": 0.9
},
"id": "CVE-2024-54683-09d3804b"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/netfilter/xt_IDLETIMER.c",
"function": "idletimer_tg_destroy"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c2c8445cda8f59c38dec7dc10509bcb23ae26a0",
"digest": {
"length": 655.0,
"function_hash": "303170957564394905321428193348132052883"
},
"id": "CVE-2024-54683-24dfba93"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/netfilter/xt_IDLETIMER.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c2c8445cda8f59c38dec7dc10509bcb23ae26a0",
"digest": {
"line_hashes": [
"191292465186373328108349890101652017125",
"24718815305528987358180211317025950124",
"159333819083494293078100298068245213528",
"216337572043005150711004826823222433873",
"141144581277918121305214269520207533366",
"31156780488923047230871912423786027754",
"278938116526650266967693570686238382297",
"157484689866173930156323902599776104174",
"50183242859006217258426224117962590256",
"129708965212540956026086486234009295731",
"262079640943611400256567604240151764740",
"158905524705048011078112051294065354908",
"192038278928248819406676953417705966033",
"265924159784930637094980800821121177999",
"325259428050311468869444936254290685218",
"262927707232518430711326921413082548580",
"276957376572856840967065792441612425356",
"24718815305528987358180211317025950124",
"159333819083494293078100298068245213528",
"91544720124194054782042781026689759529",
"283720839007257506079375947034495143279",
"159390340228775498735336697404132273719",
"261266485191573520789603929647385067319",
"42138517887928295641651549252801055147",
"104487007999956303201582382982441487045",
"148147400228544997725469749435109108487",
"99683643862057473127759699311565522755",
"157484689866173930156323902599776104174",
"50183242859006217258426224117962590256",
"129708965212540956026086486234009295731",
"262079640943611400256567604240151764740",
"158905524705048011078112051294065354908",
"192038278928248819406676953417705966033",
"265924159784930637094980800821121177999",
"110057616750513531840362628014791626330",
"115230448519603238257397079055496759916"
],
"threshold": 0.9
},
"id": "CVE-2024-54683-4fc9a0e0"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/netfilter/xt_IDLETIMER.c",
"function": "idletimer_tg_destroy_v1"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45fe76573a2557f632e248cc141342233f422b9a",
"digest": {
"length": 762.0,
"function_hash": "242530195935694608286459535404122830512"
},
"id": "CVE-2024-54683-5d5352f0"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/netfilter/xt_IDLETIMER.c",
"function": "idletimer_tg_destroy"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f36b01994d68ffc253c8296e2228dfe6e6431c03",
"digest": {
"length": 655.0,
"function_hash": "303170957564394905321428193348132052883"
},
"id": "CVE-2024-54683-6fdbdb31"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/netfilter/xt_IDLETIMER.c",
"function": "idletimer_tg_destroy_v1"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f36b01994d68ffc253c8296e2228dfe6e6431c03",
"digest": {
"length": 762.0,
"function_hash": "242530195935694608286459535404122830512"
},
"id": "CVE-2024-54683-7af1e117"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/netfilter/xt_IDLETIMER.c",
"function": "idletimer_tg_destroy_v1"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c2c8445cda8f59c38dec7dc10509bcb23ae26a0",
"digest": {
"length": 762.0,
"function_hash": "242530195935694608286459535404122830512"
},
"id": "CVE-2024-54683-c5d6461f"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/netfilter/xt_IDLETIMER.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45fe76573a2557f632e248cc141342233f422b9a",
"digest": {
"line_hashes": [
"191292465186373328108349890101652017125",
"24718815305528987358180211317025950124",
"159333819083494293078100298068245213528",
"216337572043005150711004826823222433873",
"141144581277918121305214269520207533366",
"31156780488923047230871912423786027754",
"278938116526650266967693570686238382297",
"157484689866173930156323902599776104174",
"50183242859006217258426224117962590256",
"129708965212540956026086486234009295731",
"262079640943611400256567604240151764740",
"158905524705048011078112051294065354908",
"192038278928248819406676953417705966033",
"265924159784930637094980800821121177999",
"325259428050311468869444936254290685218",
"262927707232518430711326921413082548580",
"276957376572856840967065792441612425356",
"24718815305528987358180211317025950124",
"159333819083494293078100298068245213528",
"91544720124194054782042781026689759529",
"283720839007257506079375947034495143279",
"159390340228775498735336697404132273719",
"261266485191573520789603929647385067319",
"42138517887928295641651549252801055147",
"104487007999956303201582382982441487045",
"148147400228544997725469749435109108487",
"99683643862057473127759699311565522755",
"157484689866173930156323902599776104174",
"50183242859006217258426224117962590256",
"129708965212540956026086486234009295731",
"262079640943611400256567604240151764740",
"158905524705048011078112051294065354908",
"192038278928248819406676953417705966033",
"265924159784930637094980800821121177999",
"110057616750513531840362628014791626330",
"115230448519603238257397079055496759916"
],
"threshold": 0.9
},
"id": "CVE-2024-54683-e9ae7f91"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "net/netfilter/xt_IDLETIMER.c",
"function": "idletimer_tg_destroy"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45fe76573a2557f632e248cc141342233f422b9a",
"digest": {
"length": 655.0,
"function_hash": "303170957564394905321428193348132052883"
},
"id": "CVE-2024-54683-fa0e5caf"
}
]