{
  "id": "CVE-2024-41023",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2024-07-29T15:15:11.200",
  "lastModified": "2024-11-21T09:32:05.223",
  "vulnStatus": "Undergoing Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/deadline: Fix task_struct reference leak\n\nDuring the execution of the following stress test with linux-rt:\n\nstress-ng --cyclic 30 --timeout 30 --minimize --quiet\n\nkmemleak frequently reported a memory leak concerning the task_struct:\n\nunreferenced object 0xffff8881305b8000 (size 16136):\n  comm \"stress-ng\", pid 614, jiffies 4294883961 (age 286.412s)\n  object hex dump (first 32 bytes):\n    02 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00  .@..............\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n  debug hex dump (first 16 bytes):\n    53 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00  S...............\n  backtrace:\n    [<00000000046b6790>] dup_task_struct+0x30/0x540\n    [<00000000c5ca0f0b>] copy_process+0x3d9/0x50e0\n    [<00000000ced59777>] kernel_clone+0xb0/0x770\n    [<00000000a50befdc>] __do_sys_clone+0xb6/0xf0\n    [<000000001dbf2008>] do_syscall_64+0x5d/0xf0\n    [<00000000552900ff>] entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nThe issue occurs in start_dl_timer(), which increments the task_struct\nreference count and sets a timer. The timer callback, dl_task_timer,\nis supposed to decrement the reference count upon expiration. However,\nif enqueue_task_dl() is called before the timer expires and cancels it,\nthe reference count is not decremented, leading to the leak.\n\nThis patch fixes the reference leak by ensuring the task_struct\nreference count is properly decremented when the timer is canceled."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux se ha resuelto la siguiente vulnerabilidad: sched/deadline: Reparar fuga de referencia de task_struct Durante la ejecuci\u00f3n de la siguiente prueba de estr\u00e9s con linux-rt: estr\u00e9s-ng --ciclic 30 --timeout 30 --minimize --quiet kmemleak inform\u00f3 con frecuencia una p\u00e9rdida de memoria relacionada con task_struct: objeto sin referencia 0xffff8881305b8000 (tama\u00f1o 16136): comm \"stress-ng\", pid 614, jiffies 4294883961 (edad 286.412 s) volcado hexadecimal de objeto (primeros 32 bytes): 02 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .@.............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ volcado hexadecimal de depuraci\u00f3n (primeros 16 bytes): 53 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 S............... rastreo inverso : [&lt;00000000046b6790&gt;] dup_task_struct+0x30/0x540 [&lt;00000000c5ca0f0b&gt;] copy_process+0x3d9/0x50e0 [&lt;00000000ced59777&gt;] kernel_clone+0xb0/0x770 [&lt;00000000a50befd c&gt;] __do_sys_clone+0xb6/0xf0 [&lt;000000001dbf2008&gt;] do_syscall_64+0x5d/ 0xf0 [&lt;00000000552900ff&gt;] Entry_SYSCALL_64_after_hwframe+0x6e/0x76 El problema ocurre en start_dl_timer(), que incrementa el recuento de referencias de task_struct y establece un temporizador. Se supone que la devoluci\u00f3n de llamada del temporizador, dl_task_timer, disminuye el recuento de referencia al expirar. Sin embargo, si se llama a enqueue_task_dl() antes de que expire el temporizador y lo cancela, el recuento de referencias no disminuye, lo que provoca la fuga. Este parche corrige la fuga de referencia al garantizar que el recuento de referencias de task_struct disminuya correctamente cuando se cancela el temporizador."
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/7a54d31face626f62de415ebe77b43f76c3ffaf4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b58652db66c910c2245f5bee7deca41c12d707b9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7a54d31face626f62de415ebe77b43f76c3ffaf4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://git.kernel.org/stable/c/b58652db66c910c2245f5bee7deca41c12d707b9",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}