{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-56694", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-27T15:00:39.849Z", "datePublished": "2024-12-28T09:46:18.826Z", "dateUpdated": "2025-01-09T15:35:52.606Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-01-09T15:35:52.606Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix recursive lock when verdict program return SK_PASS\n\nWhen the stream_verdict program returns SK_PASS, it places the received skb\ninto its own receive queue, but a recursive lock eventually occurs, leading\nto an operating system deadlock. This issue has been present since v6.9.\n\n'''\nsk_psock_strp_data_ready\n write_lock_bh(&sk->sk_callback_lock)\n strp_data_ready\n strp_read_sock\n read_sock -> tcp_read_sock\n strp_recv\n cb.rcv_msg -> sk_psock_strp_read\n # now stream_verdict return SK_PASS without peer sock assign\n __SK_PASS = sk_psock_map_verd(SK_PASS, NULL)\n sk_psock_verdict_apply\n sk_psock_skb_ingress_self\n sk_psock_skb_ingress_enqueue\n sk_psock_data_ready\n read_lock_bh(&sk->sk_callback_lock) <= dead lock\n\n'''\n\nThis topic has been discussed before, but it has not been fixed.\nPrevious discussion:\nhttps://lore.kernel.org/all/6684a5864ec86_403d20898@john.notmuch"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/skmsg.c"], "versions": [{"version": "6648e613226e18897231ab5e42ffc29e63fa3365", "lessThan": "078f7e1521442a55db4bed812a2fbaf02ac33819", "status": "affected", "versionType": "git"}, {"version": "c0809c128dad4c3413818384eb06a341633db973", "lessThan": "221109ba2127eabd0aa64718543638b58b15df56", "status": "affected", "versionType": "git"}, {"version": "5965bc7535fb87510b724e5465ccc1a1cf00916d", "lessThan": "6694f7acd625ed854bf6342926e771d65dad7f69", "status": "affected", "versionType": "git"}, {"version": "39dc9e1442385d6e9be0b6491ee488dddd55ae27", "lessThan": "386efa339e08563dd33e83bc951aea5d407fe578", "status": "affected", "versionType": "git"}, {"version": "b397a0ab8582c533ec0c6b732392f141fc364f87", "lessThan": "da2bc8a0c8f3ac66fdf980fc59936f851a083561", "status": "affected", "versionType": "git"}, {"version": "6648e613226e18897231ab5e42ffc29e63fa3365", "lessThan": "01f1b88acfd79103da0610b45471f6c88ea98d72", "status": "affected", "versionType": "git"}, {"version": "6648e613226e18897231ab5e42ffc29e63fa3365", "lessThan": "f84c5ef6ca23cc2f72f3b830d74f67944684bb05", "status": "affected", "versionType": "git"}, {"version": "6648e613226e18897231ab5e42ffc29e63fa3365", "lessThan": "8ca2a1eeadf09862190b2810697702d803ceef2d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/skmsg.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.289", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.233", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.174", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.120", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.64", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11.11", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.2", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/078f7e1521442a55db4bed812a2fbaf02ac33819"}, {"url": "https://git.kernel.org/stable/c/221109ba2127eabd0aa64718543638b58b15df56"}, {"url": "https://git.kernel.org/stable/c/6694f7acd625ed854bf6342926e771d65dad7f69"}, {"url": "https://git.kernel.org/stable/c/386efa339e08563dd33e83bc951aea5d407fe578"}, {"url": "https://git.kernel.org/stable/c/da2bc8a0c8f3ac66fdf980fc59936f851a083561"}, {"url": "https://git.kernel.org/stable/c/01f1b88acfd79103da0610b45471f6c88ea98d72"}, {"url": "https://git.kernel.org/stable/c/f84c5ef6ca23cc2f72f3b830d74f67944684bb05"}, {"url": "https://git.kernel.org/stable/c/8ca2a1eeadf09862190b2810697702d803ceef2d"}], "title": "bpf: fix recursive lock when verdict program return SK_PASS", "x_generator": {"engine": "bippy-5f407fcff5a0"}}}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA30912E-AC28-4CAA-B0BF-82A5ABF6555D", "versionEndExcluding": "5.11", "versionStartIncluding": "5.10.223", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AE68EECA-B500-4C8F-BA03-6297422D3BE3", "versionEndExcluding": "5.15.174", "versionStartIncluding": "5.15.159", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D7525FB8-F6DA-4FBF-A1B7-66F009E2F1FE", "versionEndExcluding": "6.1.120", "versionStartIncluding": "6.1.91", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C14BE86F-46F8-45CE-942E-3CB49D3AAB95", "versionEndExcluding": "6.6.64", "versionStartIncluding": "6.6.31", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DC02F628-9D7C-48E7-93BD-4A25BD2C74CF", "versionEndExcluding": "6.11.11", "versionStartIncluding": "6.8.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8882B1B-2ABC-4838-AC1D-DBDBB5764776", "versionEndExcluding": "6.12.2", "versionStartIncluding": "6.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix recursive lock when verdict program return SK_PASS\n\nWhen the stream_verdict program returns SK_PASS, it places the received skb\ninto its own receive queue, but a recursive lock eventually occurs, leading\nto an operating system deadlock. This issue has been present since v6.9.\n\n'''\nsk_psock_strp_data_ready\n write_lock_bh(&sk->sk_callback_lock)\n strp_data_ready\n strp_read_sock\n read_sock -> tcp_read_sock\n strp_recv\n cb.rcv_msg -> sk_psock_strp_read\n # now stream_verdict return SK_PASS without peer sock assign\n __SK_PASS = sk_psock_map_verd(SK_PASS, NULL)\n sk_psock_verdict_apply\n sk_psock_skb_ingress_self\n sk_psock_skb_ingress_enqueue\n sk_psock_data_ready\n read_lock_bh(&sk->sk_callback_lock) <= dead lock\n\n'''\n\nThis topic has been discussed before, but it has not been fixed.\nPrevious discussion:\nhttps://lore.kernel.org/all/6684a5864ec86_403d20898@john.notmuch"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: se corrige el bloqueo recursivo cuando el programa de veredicto devuelve SK_PASS Cuando el programa stream_verdict devuelve SK_PASS, coloca el skb recibido en su propia cola de recepci\u00f3n, pero finalmente se produce un bloqueo recursivo que provoca un bloqueo del sistema operativo. Este problema ha estado presente desde la versi\u00f3n v6.9. ''' sk_psock_strp_data_ready write_lock_bh(&amp;sk-&gt;sk_callback_lock) strp_data_ready strp_read_sock read_sock -&gt; tcp_read_sock strp_recv cb.rcv_msg -&gt; sk_psock_strp_read # ahora stream_verdict devuelve SK_PASS sin asignaci\u00f3n de sock de pares __SK_PASS = sk_psock_map_verd(SK_PASS, NULL) sk_psock_verdict_apply sk_psock_skb_ingress_self sk_psock_skb_ingress_enqueue sk_psock_data_ready read_lock_bh(&amp;sk-&gt;sk_callback_lock) &lt;= bloqueo muerto ''' Este tema se ha discutido antes, pero no se ha solucionado. Discusi\u00f3n anterior: https://lore.kernel.org/all/6684a5864ec86_403d20898@john.notmuch"}], "id": "CVE-2024-56694", "lastModified": "2025-01-09T16:16:23.053", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-12-28T10:15:15.203", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/01f1b88acfd79103da0610b45471f6c88ea98d72"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/078f7e1521442a55db4bed812a2fbaf02ac33819"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/221109ba2127eabd0aa64718543638b58b15df56"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/386efa339e08563dd33e83bc951aea5d407fe578"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6694f7acd625ed854bf6342926e771d65dad7f69"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8ca2a1eeadf09862190b2810697702d803ceef2d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/da2bc8a0c8f3ac66fdf980fc59936f851a083561"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f84c5ef6ca23cc2f72f3b830d74f67944684bb05"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: bpf: fix recursive lock when verdict program return SK_PASS", "id": "2334694", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334694"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: fix recursive lock when verdict program return SK_PASS\nWhen the stream_verdict program returns SK_PASS, it places the received skb\ninto its own receive queue, but a recursive lock eventually occurs, leading\nto an operating system deadlock. This issue has been present since v6.9.\n'''\nsk_psock_strp_data_ready\nwrite_lock_bh(&sk->sk_callback_lock)\nstrp_data_ready\nstrp_read_sock\nread_sock -> tcp_read_sock\nstrp_recv\ncb.rcv_msg -> sk_psock_strp_read\n# now stream_verdict return SK_PASS without peer sock assign\n__SK_PASS = sk_psock_map_verd(SK_PASS, NULL)\nsk_psock_verdict_apply\nsk_psock_skb_ingress_self\nsk_psock_skb_ingress_enqueue\nsk_psock_data_ready\nread_lock_bh(&sk->sk_callback_lock) <= dead lock\n'''\nThis topic has been discussed before, but it has not been fixed.\nPrevious discussion:\nhttps://lore.kernel.org/all/6684a5864ec86_403d20898@john.notmuch"], "name": "CVE-2024-56694", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-12-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-56694\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-56694\nhttps://lore.kernel.org/linux-cve-announce/2024122835-CVE-2024-56694-c701@gregkh/T"], "threat_severity": "Low"}