Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2024-49864

Опубликовано: 21 окт. 2024
Источник: redhat
CVSS3: 4.7
EPSS Низкий

Описание

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix a race between socket set up and I/O thread creation In rxrpc_open_socket(), it sets up the socket and then sets up the I/O thread that will handle it. This is a problem, however, as there's a gap between the two phases in which a packet may come into rxrpc_encap_rcv() from the UDP packet but we oops when trying to wake the not-yet created I/O thread. As a quick fix, just make rxrpc_encap_rcv() discard the packet if there's no I/O thread yet. A better, but more intrusive fix would perhaps be to rearrange things such that the socket creation is done by the I/O thread.

A flaw was found in the Linux kernel's rxrpc module. A race condition exists during the setup of a socket and its associated I/O thread. A remote attacker could send a specially crafted User Datagram Protocol (UDP) packet, which might be processed by rxrpc_encap_rcv() before the I/O thread is fully initialized. This could lead to a kernel 'oops', resulting in a system crash and a denial of service.

Меры по смягчению последствий

To mitigate this issue, prevent the rxrpc kernel module from loading. This can be achieved by creating a modprobe configuration file. Create a file named /etc/modprobe.d/blacklist-rxrpc.conf with the following content:

blacklist rxrpc

After creating the file, regenerate the initramfs to ensure the blacklist is applied during boot:

drancut --force # Or for older systems: mkinitrd -f /boot/initramfs-$(uname -r).img $(uname -r)

A system reboot is required for the changes to take effect. This mitigation may impact functionality that relies on the rxrpc protocol, such as AFS.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 6kernelNot affected
Red Hat Enterprise Linux 7kernelNot affected
Red Hat Enterprise Linux 7kernel-rtNot affected
Red Hat Enterprise Linux 8kernelNot affected
Red Hat Enterprise Linux 8kernel-rtNot affected
Red Hat Enterprise Linux 9kernel-rtWill not fix
Red Hat Enterprise Linux 9kernelFixedRHSA-2025:2051811.11.2025
Red Hat Enterprise Linux 9kernelFixedRHSA-2025:2051811.11.2025

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-362
https://bugzilla.redhat.com/show_bug.cgi?id=2320455kernel: rxrpc: Fix a race between socket set up and I/O thread creation

EPSS

Процентиль: 38%
0.00449
Низкий

4.7 Medium

CVSS3

Связанные уязвимости

CVSS3: 7.5
ubuntu
почти 2 года назад

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix a race between socket set up and I/O thread creation In rxrpc_open_socket(), it sets up the socket and then sets up the I/O thread that will handle it. This is a problem, however, as there's a gap between the two phases in which a packet may come into rxrpc_encap_rcv() from the UDP packet but we oops when trying to wake the not-yet created I/O thread. As a quick fix, just make rxrpc_encap_rcv() discard the packet if there's no I/O thread yet. A better, but more intrusive fix would perhaps be to rearrange things such that the socket creation is done by the I/O thread.

CVSS3: 7.5
nvd
почти 2 года назад

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix a race between socket set up and I/O thread creation In rxrpc_open_socket(), it sets up the socket and then sets up the I/O thread that will handle it. This is a problem, however, as there's a gap between the two phases in which a packet may come into rxrpc_encap_rcv() from the UDP packet but we oops when trying to wake the not-yet created I/O thread. As a quick fix, just make rxrpc_encap_rcv() discard the packet if there's no I/O thread yet. A better, but more intrusive fix would perhaps be to rearrange things such that the socket creation is done by the I/O thread.

CVSS3: 7.5
debian
почти 2 года назад

In the Linux kernel, the following vulnerability has been resolved: r ...

CVSS3: 4.7
github
почти 2 года назад

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix a race between socket set up and I/O thread creation In rxrpc_open_socket(), it sets up the socket and then sets up the I/O thread that will handle it. This is a problem, however, as there's a gap between the two phases in which a packet may come into rxrpc_encap_rcv() from the UDP packet but we oops when trying to wake the not-yet created I/O thread. As a quick fix, just make rxrpc_encap_rcv() discard the packet if there's no I/O thread yet. A better, but more intrusive fix would perhaps be to rearrange things such that the socket creation is done by the I/O thread.

CVSS3: 5.5
fstec
почти 2 года назад

Уязвимость функций rxrpc_open_socket(), rxrpc_encap_rcv() и rxrpc_io_thread() ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 38%
0.00449
Низкий

4.7 Medium

CVSS3

Уязвимость CVE-2024-49864