Race Condition Affecting kernel-modules-extra package, versions *
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-CENTOS8-KERNELMODULESEXTRA-7505066
- published 17 Jul 2024
- disclosed 16 Jul 2024
Introduced: 16 Jul 2024
CVE-2022-48784 Open this link in a new tabHow to fix?
There is no fixed version for Centos:8
kernel-modules-extra
.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-modules-extra
package and not the kernel-modules-extra
package as distributed by Centos
.
See How to fix?
for Centos:8
relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
cfg80211: fix race in netlink owner interface destruction
My previous fix here to fix the deadlock left a race where the exact same deadlock (see the original commit referenced below) can still happen if cfg80211_destroy_ifaces() already runs while nl80211_netlink_notify() is still marking some interfaces as nl_owner_dead.
The race happens because we have two loops here - first we dev_close() all the netdevs, and then we destroy them. If we also have two netdevs (first one need only be a wdev though) then we can find one during the first iteration, close it, and go to the second iteration -- but then find two, and try to destroy also the one we didn't close yet.
Fix this by only iterating once.