In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value
Currently, when the rule related to IDLETIMER is added, idletimer_tg timer structure is initialized by kmalloc on executing idletimer_tg_create function. However, in this process timer->timer_type is not defined to a specific value. Thus, timer->timer_type has garbage value and it occurs kernel panic. So, this commit fixes the panic by initializing timer->timer_type using kzalloc instead of kmalloc.
Test commands: # iptables -A OUTPUT -j IDLETIMER --timeout 1 --label test $ cat /sys/class/xt_idletimer/timers/test Killed
Splat looks like: BUG: KASAN: user-memory-access in alarm_expires_remaining+0x49/0x70 Read of size 8 at addr 0000002e8c7bc4c8 by task cat/917 CPU: 12 PID: 917 Comm: cat Not tainted 5.14.0+ #3 79940a339f71eb14fc81aee1757a20d5bf13eb0e Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: dump_stack_lvl+0x6e/0x9c kasan_report.cold+0x112/0x117 ? alarm_expires_remaining+0x49/0x70 __asan_load8+0x86/0xb0 alarm_expires_remaining+0x49/0x70 idletimer_tg_show+0xe5/0x19b [xt_IDLETIMER 11219304af9316a21bee5ba9d58f76a6b9bccc6d] dev_attr_show+0x3c/0x60 sysfs_kf_seq_show+0x11d/0x1f0 ? device_remove_bin_file+0x20/0x20 kernfs_seq_show+0xa4/0xb0 seq_read_iter+0x29c/0x750 kernfs_fop_read_iter+0x25a/0x2c0 ? __fsnotify_parent+0x3d1/0x570 ? iov_iter_init+0x70/0x90 new_sync_read+0x2a7/0x3d0 ? __x64_sys_llseek+0x230/0x230 ? rw_verify_area+0x81/0x150 vfs_read+0x17b/0x240 ksys_read+0xd9/0x180 ? vfs_write+0x460/0x460 ? do_syscall_64+0x16/0xc0 ? lockdep_hardirqs_on+0x79/0x120 __x64_sys_read+0x43/0x50 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f0cdc819142 Code: c0 e9 c2 fe ff ff 50 48 8d 3d 3a ca 0a 00 e8 f5 19 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 RSP: 002b:00007fff28eee5b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f0cdc819142 RDX: 0000000000020000 RSI: 00007f0cdc032000 RDI: 0000000000000003 RBP: 00007f0cdc032000 R08: 00007f0cdc031010 R09: 0000000000000000 R10: 0000000000000022 R11: 0000000000000246 R12: 00005607e9ee31f0 R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-develUpgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade python-perf-debuginfoUpgrade perfUpgrade python-perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-livepatch-5.10.82-83.359Upgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernel | May 22, 2025 | May 22, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 22, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 22, 2024 |
| Suse | — | Upgrade kernel-debug-vdsoUpgrade gfs2-kmp-azureUpgrade kernel-preemptUpgrade kernel-azure-develUpgrade kernel-64kb-develUpgrade dtb-rockchipUpgrade kernel-rtUpgrade dlm-kmp-64kbUpgrade kernel-kvmsmallUpgrade kernel-rt-develUpgrade kernel-rt-extraUpgrade dtb-caviumUpgrade kernel-preempt-develUpgrade kernel-devel-rtUpgrade kernel-default-base-rebuildUpgrade ocfs2-kmp-defaultUpgrade dtb-allwinnerUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade dtb-nvidiaUpgrade kernel-devel-azureUpgrade dtb-mediatekUpgrade dtb-xilinxUpgrade dtb-qcomUpgrade dtb-apmUpgrade cluster-md-kmp-rtUpgrade kernel-default-optionalUpgrade dtb-alteraUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-azureUpgrade kernel-azure-livepatch-develUpgrade dtb-sprdUpgrade kernel-develUpgrade kernel-obs-buildUpgrade kernel-azure-optionalUpgrade kernel-rt-livepatchUpgrade kernel-sourceUpgrade dtb-exynosUpgrade gfs2-kmp-rtUpgrade dtb-armUpgrade kernel-syms-azureUpgrade kselftests-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade kernel-docs-htmlUpgrade kernel-defaultUpgrade kernel-source-azureUpgrade kernel-azureUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-defaultUpgrade kernel-zfcpdumpUpgrade dtb-freescaleUpgrade kernel-default-extraUpgrade dtb-socionextUpgrade kernel-default-develUpgrade dlm-kmp-rtUpgrade kernel-64kb-extraUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-marvellUpgrade kernel-rt_debugUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-symsUpgrade kernel-debug-develUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-amdUpgrade kernel-debugUpgrade cluster-md-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-rt-optionalUpgrade ocfs2-kmp-rtUpgrade kernel-syms-rtUpgrade dtb-renesasUpgrade kselftests-kmp-rtUpgrade dtb-amazonUpgrade kernel-docsUpgrade kernel-default-livepatchUpgrade cluster-md-kmp-azureUpgrade kernel-azure-extraUpgrade dtb-lgUpgrade kernel-macrosUpgrade kselftests-kmp-azureUpgrade kernel-64kb-optionalUpgrade dlm-kmp-azureUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-rtUpgrade kernel-rt-vdsoUpgrade kernel-obs-qaUpgrade reiserfs-kmp-defaultUpgrade dtb-amlogicUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-azure-vdsoUpgrade gfs2-kmp-64kbUpgrade dtb-broadcomUpgrade kernel-debug-livepatch-develUpgrade kernel-rt_debug-develUpgrade kernel-source-rtUpgrade dtb-appleUpgrade kernel-default-baseUpgrade reiserfs-kmp-64kbUpgrade kernel-64kbUpgrade kernel-kvmsmall-develUpgrade dtb-hisilicon | Aug 9, 2024 | May 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub