CVE-2024-41045

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the bpf timer cancel and free function in the Linux kernel, where two timer callbacks trying to cancel each other can lead to a deadlock situation. This can be invoked through bpf map update elem, specifically when freeing map elements containing timers. The problem can be fixed by using hrtimer try to cancel, as the timer cannot be enqueued after async cancel and free. However, there exists a UAF scenario where the callback arms the timer before entering this function, and if cancellation fails, the RCU grace period expiration can free the bpf hrtimer state and the struct hrtimer. To resolve this, the bpf timer cancel and free function is modified to defer work to the global workqueue, adding a work struct alongside rcu head.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.