CVE-2024-42239: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's BPF timer cancellation mechanism has been identified as CVE-2024-42239. The issue affects Linux kernel versions from 5.15 up to (excluding) 6.6.41 and from 6.7 up to (excluding) 6.9.10. The vulnerability was discovered in July 2024 and involves a potential deadlock situation in the bpf_timer_cancel functionality (NVD).

The vulnerability occurs when two BPF timer callbacks attempt to cancel each other's timers simultaneously. Given a scenario where timer1 and timer2 callbacks are executing, if bpf_timer_cancel(timer2) and bpf_timer_cancel(timer1) are called, both cancellation calls would wait for the other callback to finish executing, introducing a lockup. The issue has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD, Kernel Patch).

The vulnerability can lead to a denial of service condition through a deadlock in the kernel's BPF timer subsystem. When exploited, it can cause system lockups due to timer callbacks becoming deadlocked while attempting to cancel each other (NVD).

The vulnerability requires local access and can be triggered when BPF timer callbacks attempt to cancel each other while executing in parallel. The attack complexity is considered low, but it requires local user privileges to exploit (NVD).

The vulnerability has been patched by adding an atomic_t count named 'cancelling' in bpf_hrtimer to track in-flight cancellation requests. The fix implements a mechanism to detect potential deadlock situations and fail the cancellation operation with -EDEADLK error when necessary. Users should update to Linux kernel versions 6.6.41, 6.9.10, or later to receive the fix (Kernel Patch).