Excessive Iteration Affecting kernel-rt-debug-core package, versions *
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-CENTOS8-KERNELRTDEBUGCORE-7824831
- published 23 Aug 2024
- disclosed 22 Aug 2024
Introduced: 22 Aug 2024
CVE-2022-48939 Open this link in a new tabHow to fix?
There is no fixed version for Centos:8 kernel-rt-debug-core.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-rt-debug-core package and not the kernel-rt-debug-core package as distributed by Centos.
See How to fix? for Centos:8 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
bpf: Add schedule points in batch ops
syzbot reported various soft lockups caused by bpf batch operations.
INFO: task kworker/1:1:27 blocked for more than 140 seconds. INFO: task hung in rcu_barrier
Nothing prevents batch ops to process huge amount of data, we need to add schedule points in them.
Note that maybe_wait_bpf_programs(map) calls from generic_map_delete_batch() can be factorized by moving the call after the loop.
This will be done later in -next tree once we get this fix merged, unless there is strong opinion doing this optimization sooner.
References
- https://access.redhat.com/security/cve/CVE-2022-48939
- https://git.kernel.org/stable/c/75134f16e7dd0007aa474b281935c5f42e79f2c8
- https://git.kernel.org/stable/c/7e8099967d0e3ff9d1ae043e80b27fbe46c08417
- https://git.kernel.org/stable/c/7ef94bfb08fb9e73defafbd5ddef6b5a0e2ee12b
- https://git.kernel.org/stable/c/8628f489b749a4f9767991631921dbe3fbcdc784