In the Linux kernel, the following vulnerability has been resolved:
mac80211-hwsim: fix late beacon hrtimer handling
Thomas explained in https://lore.kernel.org/r/87mtoeb4hb.ffs@tglx that our handling of the hrtimer here is wrong: If the timer fires late (e.g. due to vCPU scheduling, as reported by Dmitry/syzbot) then it tries to actually rearm the timer at the next deadline, which might be in the past already:
1 2 3 N N+1 | | | ... | |
^ intended to fire here (1) ^ next deadline here (2) ^ actually fired here
The next time it fires, it's later, but will still try to schedule for the next deadline (now 3), etc. until it catches up with N, but that might take a long time, causing stalls etc.
Now, all of this is simulation, so we just have to fix it, but note that the behaviour is wrong even per spec, since there's no value then in sending all those beacons unaligned - they should be aligned to the TBTT (1, 2, 3, ... in the picture), and if we're a bit (or a lot) late, then just resume at that point.
Therefore, change the code to use hrtimer_forward_now() which will ensure that the next firing of the timer would be at N+1 (in the picture), i.e. the next interval point after the current time.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-macrosUpgrade dlm-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-optionalUpgrade kernel-obs-qaUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-azureUpgrade kernel-devel-azureUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade dtb-lgUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-livepatch-develUpgrade ocfs2-kmp-rtUpgrade kernel-obs-buildUpgrade kernel-default-extraUpgrade dtb-broadcomUpgrade gfs2-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-kvmsmall-develUpgrade dtb-apmUpgrade kernel-rtUpgrade dtb-marvellUpgrade dtb-amlogicUpgrade kernel-debug-vdsoUpgrade kernel-syms-azureUpgrade kernel-sourceUpgrade kernel-rt-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade kernel-default-base-rebuildUpgrade kernel-azure-vdsoUpgrade kernel-docsUpgrade kernel-azure-develUpgrade kernel-rt_debugUpgrade kernel-source-rtUpgrade kernel-preemptUpgrade cluster-md-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmallUpgrade kernel-default-livepatchUpgrade kernel-azure-livepatch-develUpgrade dtb-rockchipUpgrade dtb-qcomUpgrade reiserfs-kmp-64kbUpgrade kernel-docs-htmlUpgrade dtb-socionextUpgrade ocfs2-kmp-64kbUpgrade dtb-exynosUpgrade kernel-syms-rtUpgrade kernel-source-azureUpgrade kernel-default-optionalUpgrade kernel-default-livepatch-develUpgrade dtb-appleUpgrade dtb-freescaleUpgrade dtb-hisiliconUpgrade dtb-renesasUpgrade kernel-azure-optionalUpgrade kernel-develUpgrade kernel-64kb-develUpgrade kselftests-kmp-64kbUpgrade kernel-rt-develUpgrade kernel-devel-rtUpgrade dlm-kmp-rtUpgrade kernel-preempt-develUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-vdsoUpgrade kernel-rt_debug-livepatch-develUpgrade cluster-md-kmp-rtUpgrade kernel-rt_debug-develUpgrade dtb-armUpgrade dtb-nvidiaUpgrade kernel-azure-extraUpgrade dtb-mediatekUpgrade gfs2-kmp-64kbUpgrade kernel-symsUpgrade reiserfs-kmp-defaultUpgrade kernel-64kb-livepatch-develUpgrade reiserfs-kmp-rtUpgrade dtb-amdUpgrade kernel-source-vanillaUpgrade dtb-sprdUpgrade kernel-rt-livepatchUpgrade kernel-debugUpgrade dtb-caviumUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-64kbUpgrade kernel-azureUpgrade kernel-debug-develUpgrade dtb-alteraUpgrade kernel-default-develUpgrade kernel-default-baseUpgrade dtb-allwinnerUpgrade kernel-64kb-optionalUpgrade dtb-xilinxUpgrade dtb-amazonUpgrade kernel-64kb-extraUpgrade kernel-64kbUpgrade kselftests-kmp-rtUpgrade kernel-defaultUpgrade gfs2-kmp-defaultUpgrade gfs2-kmp-azure | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-aws-fipsUpgrade linux-awsUpgrade linux-raspiUpgrade linuxUpgrade linux-gkeopUpgrade linux-ibmUpgrade linux-aws-5.4Upgrade linux-azureUpgrade linux-azure-fipsUpgrade linux-azure-5.4Upgrade linux-hwe-5.4Upgrade linux-raspi-5.4Upgrade linux-gcp-fipsUpgrade linux-kvmUpgrade linux-gcp-5.4Upgrade linux-gcpUpgrade linux-oracleUpgrade linux-fipsUpgrade linux-oracle-5.4Upgrade linux-bluefield | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub