Race Condition Affecting kernel-debug package, versions <0:4.18.0-553.5.1.el8_10


Severity

Recommended
0.0
medium
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.04% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-KERNELDEBUG-6481115
  • published22 Mar 2024
  • disclosed21 Mar 2024

Introduced: 21 Mar 2024

CVE-2024-26643  (opens in a new tab)
CWE-362  (opens in a new tab)
First added by Snyk

How to fix?

Upgrade RHEL:8 kernel-debug to version 0:4.18.0-553.5.1.el8_10 or higher.
This issue was patched in RHSA-2024:3618.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-debug package and not the kernel-debug package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout

While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path.

Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set element timeout").

Fix this by setting on the dead flag for anonymous sets to skip async gc in this case.

According to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on transaction abort"), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too.

CVSS Scores

version 3.1