In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value
Currently, when the rule related to IDLETIMER is added, idletimer_tg timer structure is initialized by kmalloc on executing idletimer_tg_create function. However, in this process timer->timer_type is not defined to a specific value. Thus, timer->timer_type has garbage value and it occurs kernel panic. So, this commit fixes the panic by initializing timer->timer_type using kzalloc instead of kmalloc.
Test commands: # iptables -A OUTPUT -j IDLETIMER --timeout 1 --label test $ cat /sys/class/xt_idletimer/timers/test Killed
Splat looks like: BUG: KASAN: user-memory-access in alarm_expires_remaining+0x49/0x70 Read of size 8 at addr 0000002e8c7bc4c8 by task cat/917 CPU: 12 PID: 917 Comm: cat Not tainted 5.14.0+ #3 79940a339f71eb14fc81aee1757a20d5bf13eb0e Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: dump_stack_lvl+0x6e/0x9c kasan_report.cold+0x112/0x117 ? alarm_expires_remaining+0x49/0x70 __asan_load8+0x86/0xb0 alarm_expires_remaining+0x49/0x70 idletimer_tg_show+0xe5/0x19b [xt_IDLETIMER 11219304af9316a21bee5ba9d58f76a6b9bccc6d] dev_attr_show+0x3c/0x60 sysfs_kf_seq_show+0x11d/0x1f0 ? device_remove_bin_file+0x20/0x20 kernfs_seq_show+0xa4/0xb0 seq_read_iter+0x29c/0x750 kernfs_fop_read_iter+0x25a/0x2c0 ? __fsnotify_parent+0x3d1/0x570 ? iov_iter_init+0x70/0x90 new_sync_read+0x2a7/0x3d0 ? __x64_sys_llseek+0x230/0x230 ? rw_verify_area+0x81/0x150 vfs_read+0x17b/0x240 ksys_read+0xd9/0x180 ? vfs_write+0x460/0x460 ? do_syscall_64+0x16/0xc0 ? lockdep_hardirqs_on+0x79/0x120 __x64_sys_read+0x43/0x50 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f0cdc819142 Code: c0 e9 c2 fe ff ff 50 48 8d 3d 3a ca 0a 00 e8 f5 19 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 RSP: 002b:00007fff28eee5b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f0cdc819142 RDX: 0000000000020000 RSI: 00007f0cdc032000 RDI: 0000000000000003 RBP: 00007f0cdc032000 R08: 00007f0cdc031010 R09: 0000000000000000 R10: 0000000000000022 R11: 0000000000000246 R12: 00005607e9ee31f0 R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-toolsUpgrade kernel-develUpgrade kernel-livepatch-5.10.82-83.359Upgrade python-perfUpgrade bpftoolUpgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade perfUpgrade kernel-debuginfoUpgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-tools-devel | May 22, 2025 | May 22, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 22, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 22, 2024 |
| Suse | — | Upgrade dtb-armUpgrade kernel-64kb-develUpgrade gfs2-kmp-rtUpgrade kernel-azure-develUpgrade kernel-rt-develUpgrade kernel-debug-vdsoUpgrade dlm-kmp-64kbUpgrade dtb-caviumUpgrade kernel-preemptUpgrade kernel-preempt-develUpgrade gfs2-kmp-azureUpgrade kernel-rtUpgrade dtb-exynosUpgrade ocfs2-kmp-defaultUpgrade kernel-develUpgrade kernel-rt-livepatchUpgrade dtb-sprdUpgrade dtb-rockchipUpgrade dtb-allwinnerUpgrade dtb-nvidiaUpgrade kernel-azure-optionalUpgrade kernel-devel-rtUpgrade kernel-rt-extraUpgrade kernel-obs-buildUpgrade kselftests-kmp-64kbUpgrade kernel-default-base-rebuildUpgrade dtb-xilinxUpgrade dtb-qcomUpgrade kernel-azure-livepatch-develUpgrade dtb-mediatekUpgrade cluster-md-kmp-64kbUpgrade kernel-sourceUpgrade kernel-devel-azureUpgrade reiserfs-kmp-azureUpgrade dtb-apmUpgrade kernel-default-optionalUpgrade kernel-syms-azureUpgrade kernel-default-vdsoUpgrade cluster-md-kmp-rtUpgrade dtb-alteraUpgrade kernel-kvmsmallUpgrade kernel-default-baseUpgrade kernel-source-vanillaUpgrade dlm-kmp-azureUpgrade kernel-rt-vdsoUpgrade kernel-rt_debug-develUpgrade kernel-source-rtUpgrade dtb-renesasUpgrade kernel-obs-qaUpgrade dtb-amlogicUpgrade reiserfs-kmp-rtUpgrade kernel-zfcpdumpUpgrade kernel-64kbUpgrade kernel-azureUpgrade kernel-default-livepatchUpgrade kernel-azure-extraUpgrade cluster-md-kmp-azureUpgrade kernel-macrosUpgrade kernel-syms-rtUpgrade kernel-source-azureUpgrade kernel-docsUpgrade kselftests-kmp-azureUpgrade dtb-hisiliconUpgrade ocfs2-kmp-rtUpgrade dtb-lgUpgrade ocfs2-kmp-64kbUpgrade kernel-64kb-optionalUpgrade kernel-default-livepatch-develUpgrade kernel-symsUpgrade kernel-64kb-livepatch-develUpgrade kernel-defaultUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade gfs2-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-64kbUpgrade dtb-broadcomUpgrade kernel-debug-livepatch-develUpgrade kselftests-kmp-defaultUpgrade dtb-appleUpgrade kernel-docs-htmlUpgrade kernel-azure-vdsoUpgrade reiserfs-kmp-defaultUpgrade dtb-marvellUpgrade kernel-default-develUpgrade dtb-socionextUpgrade dlm-kmp-rtUpgrade dtb-freescaleUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-extraUpgrade kernel-64kb-extraUpgrade dlm-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade kselftests-kmp-rtUpgrade dtb-amdUpgrade kernel-debugUpgrade kernel-rt_debugUpgrade ocfs2-kmp-azureUpgrade kernel-rt-optionalUpgrade cluster-md-kmp-defaultUpgrade dtb-amazonUpgrade kernel-debug-devel | Aug 9, 2024 | May 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub