In the Linux kernel, the following vulnerability has been resolved:
mac80211-hwsim: fix late beacon hrtimer handling
Thomas explained in https://lore.kernel.org/r/87mtoeb4hb.ffs@tglx that our handling of the hrtimer here is wrong: If the timer fires late (e.g. due to vCPU scheduling, as reported by Dmitry/syzbot) then it tries to actually rearm the timer at the next deadline, which might be in the past already:
1 2 3 N N+1 | | | ... | |
^ intended to fire here (1) ^ next deadline here (2) ^ actually fired here
The next time it fires, it's later, but will still try to schedule for the next deadline (now 3), etc. until it catches up with N, but that might take a long time, causing stalls etc.
Now, all of this is simulation, so we just have to fix it, but note that the behaviour is wrong even per spec, since there's no value then in sending all those beacons unaligned - they should be aligned to the TBTT (1, 2, 3, ... in the picture), and if we're a bit (or a lot) late, then just resume at that point.
Therefore, change the code to use hrtimer_forward_now() which will ensure that the next firing of the timer would be at N+1 (in the picture), i.e. the next interval point after the current time.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-debug-livepatch-develUpgrade gfs2-kmp-rtUpgrade dtb-socionextUpgrade kernel-azure-vdsoUpgrade kernel-preemptUpgrade kernel-sourceUpgrade kernel-docsUpgrade dtb-rockchipUpgrade kernel-docs-htmlUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade kernel-default-base-rebuildUpgrade kernel-obs-qaUpgrade dtb-exynosUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-azureUpgrade kernel-debug-vdsoUpgrade kernel-rtUpgrade kernel-default-livepatchUpgrade kernel-kvmsmall-vdsoUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade dtb-apmUpgrade kernel-syms-rtUpgrade ocfs2-kmp-rtUpgrade dtb-broadcomUpgrade dtb-qcomUpgrade kernel-syms-azureUpgrade kselftests-kmp-defaultUpgrade kernel-default-extraUpgrade dtb-amlogicUpgrade dtb-lgUpgrade kernel-rt_debugUpgrade kernel-obs-buildUpgrade kernel-source-azureUpgrade cluster-md-kmp-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-azure-develUpgrade kernel-kvmsmallUpgrade kernel-zfcpdumpUpgrade kernel-devel-azureUpgrade kernel-source-rtUpgrade kernel-kvmsmall-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-optionalUpgrade kernel-macrosUpgrade dlm-kmp-azureUpgrade dtb-marvellUpgrade kernel-azure-livepatch-develUpgrade kernel-rt-extraUpgrade kernel-azure-extraUpgrade kernel-devel-rtUpgrade kernel-debug-develUpgrade kernel-symsUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-64kbUpgrade kselftests-kmp-rtUpgrade dtb-caviumUpgrade kernel-64kb-optionalUpgrade dtb-alteraUpgrade kernel-preempt-develUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade dtb-appleUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt_debug-livepatch-develUpgrade ocfs2-kmp-defaultUpgrade kernel-default-vdsoUpgrade cluster-md-kmp-rtUpgrade kernel-default-optionalUpgrade dlm-kmp-rtUpgrade dtb-armUpgrade reiserfs-kmp-azureUpgrade dtb-freescaleUpgrade kernel-rt-livepatchUpgrade dtb-sprdUpgrade dtb-mediatekUpgrade reiserfs-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-source-vanillaUpgrade kernel-default-develUpgrade dtb-amdUpgrade kernel-64kbUpgrade dtb-renesasUpgrade kernel-defaultUpgrade dtb-hisiliconUpgrade kernel-64kb-develUpgrade kernel-azureUpgrade dlm-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade kernel-azure-optionalUpgrade kernel-develUpgrade kernel-rt_debug-develUpgrade kernel-default-baseUpgrade dtb-amazonUpgrade kernel-debugUpgrade kernel-64kb-extraUpgrade dtb-xilinxUpgrade dtb-allwinnerUpgrade cluster-md-kmp-64kbUpgrade gfs2-kmp-azureUpgrade kselftests-kmp-64kbUpgrade dtb-nvidiaUpgrade kernel-rt-devel | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-aws-fipsUpgrade linux-azure-5.4Upgrade linux-awsUpgrade linux-gkeopUpgrade linux-raspiUpgrade linux-azureUpgrade linux-ibmUpgrade linuxUpgrade linux-azure-fipsUpgrade linux-aws-5.4Upgrade linux-hwe-5.4Upgrade linux-bluefieldUpgrade linux-kvmUpgrade linux-oracleUpgrade linux-raspi-5.4Upgrade linux-gcp-fipsUpgrade linux-oracle-5.4Upgrade linux-gcp-5.4Upgrade linux-gcpUpgrade linux-fips | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub