In the Linux kernel, the following vulnerability has been resolved:
mac80211-hwsim: fix late beacon hrtimer handling
Thomas explained in https://lore.kernel.org/r/87mtoeb4hb.ffs@tglx that our handling of the hrtimer here is wrong: If the timer fires late (e.g. due to vCPU scheduling, as reported by Dmitry/syzbot) then it tries to actually rearm the timer at the next deadline, which might be in the past already:
1 2 3 N N+1 | | | ... | |
^ intended to fire here (1) ^ next deadline here (2) ^ actually fired here
The next time it fires, it's later, but will still try to schedule for the next deadline (now 3), etc. until it catches up with N, but that might take a long time, causing stalls etc.
Now, all of this is simulation, so we just have to fix it, but note that the behaviour is wrong even per spec, since there's no value then in sending all those beacons unaligned - they should be aligned to the TBTT (1, 2, 3, ... in the picture), and if we're a bit (or a lot) late, then just resume at that point.
Therefore, change the code to use hrtimer_forward_now() which will ensure that the next firing of the timer would be at N+1 (in the picture), i.e. the next interval point after the current time.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-rt-vdsoUpgrade kselftests-kmp-azureUpgrade dtb-apmUpgrade kernel-debug-vdsoUpgrade kernel-azure-develUpgrade kernel-kvmsmall-develUpgrade kernel-rt-optionalUpgrade dtb-socionextUpgrade ocfs2-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade kernel-syms-rtUpgrade kernel-kvmsmallUpgrade kernel-azure-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-default-livepatchUpgrade dtb-broadcomUpgrade gfs2-kmp-rtUpgrade cluster-md-kmp-azureUpgrade kernel-docs-htmlUpgrade kernel-rt-livepatch-develUpgrade kernel-azure-livepatch-develUpgrade kernel-preemptUpgrade kernel-docsUpgrade kernel-debug-livepatch-develUpgrade dtb-rockchipUpgrade dtb-amlogicUpgrade kernel-obs-buildUpgrade kernel-default-extraUpgrade kernel-kvmsmall-vdsoUpgrade kselftests-kmp-defaultUpgrade kernel-obs-qaUpgrade kernel-zfcpdumpUpgrade dlm-kmp-defaultUpgrade dtb-exynosUpgrade kernel-source-azureUpgrade kernel-default-base-rebuildUpgrade kernel-sourceUpgrade kernel-rtUpgrade kernel-rt_debugUpgrade ocfs2-kmp-rtUpgrade kernel-syms-azureUpgrade dtb-lgUpgrade kernel-macrosUpgrade kernel-rt_debug-vdsoUpgrade dlm-kmp-azureUpgrade kernel-rt-extraUpgrade dtb-marvellUpgrade kernel-devel-azureUpgrade dtb-qcomUpgrade kernel-source-vanillaUpgrade cluster-md-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade dtb-appleUpgrade kernel-defaultUpgrade dtb-sprdUpgrade dtb-mediatekUpgrade dtb-amdUpgrade kernel-rt-livepatchUpgrade ocfs2-kmp-azureUpgrade kernel-64kbUpgrade gfs2-kmp-64kbUpgrade dtb-nvidiaUpgrade kernel-default-vdsoUpgrade kernel-azureUpgrade gfs2-kmp-azureUpgrade kernel-devel-rtUpgrade dlm-kmp-rtUpgrade kernel-default-optionalUpgrade kernel-64kb-optionalUpgrade dtb-allwinnerUpgrade dtb-caviumUpgrade kernel-rt_debug-develUpgrade kernel-default-baseUpgrade dlm-kmp-64kbUpgrade kernel-develUpgrade cluster-md-kmp-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-debug-develUpgrade kselftests-kmp-64kbUpgrade dtb-alteraUpgrade kernel-default-develUpgrade dtb-armUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-azureUpgrade dtb-hisiliconUpgrade kernel-azure-optionalUpgrade dtb-renesasUpgrade dtb-freescaleUpgrade ocfs2-kmp-defaultUpgrade kernel-64kb-develUpgrade dtb-amazonUpgrade dtb-xilinxUpgrade kselftests-kmp-rtUpgrade kernel-debugUpgrade kernel-64kb-extraUpgrade kernel-symsUpgrade kernel-64kb-livepatch-develUpgrade kernel-azure-extraUpgrade kernel-default-livepatch-develUpgrade kernel-preempt-develUpgrade kernel-rt-devel | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-aws-5.4Upgrade linux-azureUpgrade linuxUpgrade linux-gkeopUpgrade linux-ibmUpgrade linux-azure-5.4Upgrade linux-azure-fipsUpgrade linux-awsUpgrade linux-hwe-5.4Upgrade linux-aws-fipsUpgrade linux-raspiUpgrade linux-kvmUpgrade linux-bluefieldUpgrade linux-oracle-5.4Upgrade linux-gcpUpgrade linux-raspi-5.4Upgrade linux-fipsUpgrade linux-oracleUpgrade linux-gcp-5.4Upgrade linux-gcp-fips | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub