CVE-2024-26737 in Linux
Summary
by MITRE • 04/03/2024
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel
The following race is possible between bpf_timer_cancel_and_free and bpf_timer_cancel. It will lead a UAF on the timer->timer.
bpf_timer_cancel(); spin_lock(); t = timer->time; spin_unlock();
bpf_timer_cancel_and_free(); spin_lock(); t = timer->timer; timer->timer = NULL; spin_unlock(); hrtimer_cancel(&t->timer); kfree(t);
/* UAF on t */ hrtimer_cancel(&t->timer);
In bpf_timer_cancel_and_free, this patch frees the timer->timer after a rcu grace period. This requires a rcu_head addition to the "struct bpf_hrtimer". Another kfree(t) happens in bpf_timer_init, this does not need a kfree_rcu because it is still under the spin_lock and timer->timer has not been visible by others yet.
In bpf_timer_cancel, rcu_read_lock() is added because this helper can be used in a non rcu critical section context (e.g. from a sleepable bpf prog). Other timer->timer usages in helpers.c have been audited, bpf_timer_cancel() is the only place where timer->timer is used outside of the spin_lock.
Another solution considered is to mark a t->flag in bpf_timer_cancel and clear it after hrtimer_cancel() is done. In bpf_timer_cancel_and_free, it busy waits for the flag to be cleared before kfree(t). This patch goes with a straight forward solution and frees timer->timer after a rcu grace period.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2025
The vulnerability described in CVE-2024-26737 represents a critical race condition within the Linux kernel's eBPF (extended Berkeley Packet Filter) subsystem, specifically affecting the bpf_timer_cancel_and_free and bpf_timer_cancel functions. This issue manifests as a use-after-free (UAF) condition that can potentially lead to system instability or privilege escalation. The vulnerability occurs when multiple threads simultaneously execute these timer management functions, creating a scenario where a timer structure becomes freed while another execution path attempts to access it, violating fundamental memory safety principles. Such race conditions are particularly dangerous in kernel space where improper memory management can result in arbitrary code execution or system crashes.
The technical flaw stems from insufficient synchronization mechanisms between the bpf_timer_cancel_and_free and bpf_timer_cancel functions, creating a window where timer->timer can be accessed after being freed. The race condition occurs when bpf_timer_cancel_and_free executes first, freeing the timer structure and setting timer->timer to NULL, while bpf_timer_cancel is concurrently executing and attempting to use the timer structure through the variable t. This creates a classic UAF scenario where the memory location previously occupied by the timer structure is accessed after it has been deallocated, potentially leading to memory corruption or information disclosure. The vulnerability is classified under CWE-362, which specifically addresses race conditions that can result in security flaws.
The operational impact of this vulnerability extends beyond simple system instability, as it represents a potential privilege escalation vector within the kernel. When exploited, this race condition could allow unprivileged users to gain elevated privileges or cause denial of service through kernel memory corruption. The vulnerability affects the bpf_timer_cancel function which can be invoked from sleepable BPF programs, making it particularly concerning as it operates in contexts where RCU (Read-Copy-Update) mechanisms are not guaranteed to be active. This makes the vulnerability more prevalent and harder to predict in various execution environments, as it can be triggered from multiple code paths within the kernel's BPF subsystem.
The fix implemented addresses the race condition through a straightforward but effective approach that adds proper RCU grace period handling to the timer freeing mechanism. The solution involves modifying the bpf_hrtimer structure to include a rcu_head member, ensuring that timer->timer is freed only after a proper RCU grace period has elapsed, preventing the UAF condition. Additionally, the patch adds rcu_read_lock() to bpf_timer_cancel to ensure proper context handling when the function is called from non-RCU critical sections, such as sleepable BPF programs. This approach follows ATT&CK technique T1068 by potentially enabling privilege escalation through kernel memory corruption, while also addressing the underlying synchronization issue through proper kernel memory management practices. The implementation avoids more complex solutions such as busy-waiting or flag-based synchronization, instead relying on the established RCU framework to ensure memory safety. The fix also addresses inconsistencies in memory management patterns by ensuring that kfree operations in bpf_timer_init do not require kfree_rcu since they occur within spin_lock critical sections where the timer is not yet visible to other threads, maintaining the integrity of the overall memory management approach.