In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value
Currently, when the rule related to IDLETIMER is added, idletimer_tg timer structure is initialized by kmalloc on executing idletimer_tg_create function. However, in this process timer->timer_type is not defined to a specific value. Thus, timer->timer_type has garbage value and it occurs kernel panic. So, this commit fixes the panic by initializing timer->timer_type using kzalloc instead of kmalloc.
Test commands: # iptables -A OUTPUT -j IDLETIMER --timeout 1 --label test $ cat /sys/class/xt_idletimer/timers/test Killed
Splat looks like: BUG: KASAN: user-memory-access in alarm_expires_remaining+0x49/0x70 Read of size 8 at addr 0000002e8c7bc4c8 by task cat/917 CPU: 12 PID: 917 Comm: cat Not tainted 5.14.0+ #3 79940a339f71eb14fc81aee1757a20d5bf13eb0e Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: dump_stack_lvl+0x6e/0x9c kasan_report.cold+0x112/0x117 ? alarm_expires_remaining+0x49/0x70 __asan_load8+0x86/0xb0 alarm_expires_remaining+0x49/0x70 idletimer_tg_show+0xe5/0x19b [xt_IDLETIMER 11219304af9316a21bee5ba9d58f76a6b9bccc6d] dev_attr_show+0x3c/0x60 sysfs_kf_seq_show+0x11d/0x1f0 ? device_remove_bin_file+0x20/0x20 kernfs_seq_show+0xa4/0xb0 seq_read_iter+0x29c/0x750 kernfs_fop_read_iter+0x25a/0x2c0 ? __fsnotify_parent+0x3d1/0x570 ? iov_iter_init+0x70/0x90 new_sync_read+0x2a7/0x3d0 ? __x64_sys_llseek+0x230/0x230 ? rw_verify_area+0x81/0x150 vfs_read+0x17b/0x240 ksys_read+0xd9/0x180 ? vfs_write+0x460/0x460 ? do_syscall_64+0x16/0xc0 ? lockdep_hardirqs_on+0x79/0x120 __x64_sys_read+0x43/0x50 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f0cdc819142 Code: c0 e9 c2 fe ff ff 50 48 8d 3d 3a ca 0a 00 e8 f5 19 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 RSP: 002b:00007fff28eee5b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f0cdc819142 RDX: 0000000000020000 RSI: 00007f0cdc032000 RDI: 0000000000000003 RBP: 00007f0cdc032000 R08: 00007f0cdc031010 R09: 0000000000000000 R10: 0000000000000022 R11: 0000000000000246 R12: 00005607e9ee31f0 R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perf-debuginfoUpgrade perfUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-tools-develUpgrade bpftoolUpgrade kernel-livepatch-5.10.82-83.359Upgrade kernel-toolsUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-debuginfo-common-aarch64 | May 22, 2025 | May 22, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 22, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 22, 2024 |
| Suse | — | Upgrade kernel-develUpgrade kernel-sourceUpgrade dtb-caviumUpgrade kernel-rt-extraUpgrade dtb-exynosUpgrade dtb-nvidiaUpgrade dtb-sprdUpgrade kernel-azure-optionalUpgrade kernel-obs-buildUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-azureUpgrade kernel-preemptUpgrade dtb-xilinxUpgrade kernel-preempt-develUpgrade dtb-mediatekUpgrade kernel-default-optionalUpgrade reiserfs-kmp-azureUpgrade kernel-debug-vdsoUpgrade dtb-alteraUpgrade cluster-md-kmp-rtUpgrade kselftests-kmp-64kbUpgrade dtb-apmUpgrade kernel-default-vdsoUpgrade kernel-azure-livepatch-develUpgrade kernel-devel-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-develUpgrade cluster-md-kmp-64kbUpgrade kernel-64kb-develUpgrade dtb-armUpgrade dtb-allwinnerUpgrade dtb-qcomUpgrade kernel-syms-azureUpgrade gfs2-kmp-rtUpgrade kernel-rt-livepatchUpgrade kernel-kvmsmallUpgrade kernel-devel-rtUpgrade kernel-azure-develUpgrade kernel-default-base-rebuildUpgrade kernel-rtUpgrade dtb-rockchipUpgrade kernel-symsUpgrade kernel-source-rtUpgrade dtb-renesasUpgrade kernel-default-livepatchUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-azureUpgrade kernel-syms-rtUpgrade kernel-azure-extraUpgrade kernel-docsUpgrade dtb-lgUpgrade cluster-md-kmp-azureUpgrade kernel-macrosUpgrade kselftests-kmp-defaultUpgrade kernel-default-develUpgrade dtb-amdUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-marvellUpgrade kernel-default-extraUpgrade kernel-docs-htmlUpgrade kernel-defaultUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azureUpgrade dtb-hisiliconUpgrade kernel-64kbUpgrade ocfs2-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-zfcpdumpUpgrade kernel-64kb-optionalUpgrade ocfs2-kmp-azureUpgrade kernel-default-livepatch-develUpgrade dtb-amlogicUpgrade kernel-rt-vdsoUpgrade kernel-default-baseUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-azureUpgrade kernel-rt_debug-develUpgrade kernel-debug-develUpgrade kernel-64kb-extraUpgrade dtb-socionextUpgrade kernel-debugUpgrade dtb-freescaleUpgrade kernel-rt_debug-livepatch-develUpgrade dlm-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-rt_debugUpgrade reiserfs-kmp-defaultUpgrade dtb-appleUpgrade dtb-broadcomUpgrade gfs2-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-rt_debug-vdsoUpgrade kernel-obs-qaUpgrade kernel-rt-optionalUpgrade kselftests-kmp-rtUpgrade dtb-amazonUpgrade kernel-source-vanilla | Aug 9, 2024 | May 22, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub