Race Condition Affecting kernel-rt-kvm package, versions <0:4.18.0-553.27.1.rt7.368.el8_10


Severity

Recommended
0.0
medium
0
10

Based on Rocky Linux security rating.

Threat Intelligence

EPSS
0.04% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Race Condition vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-ROCKY8-KERNELRTKVM-8364517
  • published9 Nov 2024
  • disclosed9 Oct 2024

Introduced: 9 Oct 2024

CVE-2024-47668  (opens in a new tab)
CWE-362  (opens in a new tab)

How to fix?

Upgrade Rocky-Linux:8 kernel-rt-kvm to version 0:4.18.0-553.27.1.rt7.368.el8_10 or higher.
This issue was patched in RLSA-2024:8870.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-rt-kvm package and not the kernel-rt-kvm package as distributed by Rocky-Linux. See How to fix? for Rocky-Linux:8 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()

If we need to increase the tree depth, allocate a new node, and then race with another thread that increased the tree depth before us, we'll still have a preallocated node that might be used later.

If we then use that node for a new non-root node, it'll still have a pointer to the old root instead of being zeroed - fix this by zeroing it in the cmpxchg failure path.

CVSS Scores

version 3.1