{"id":"CVE-2024-43887","summary":"net/tcp: Disable TCP-AO static key after RCU grace period","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tcp: Disable TCP-AO static key after RCU grace period\n\nThe lifetime of TCP-AO static_key is the same as the last\ntcp_ao_info. On the socket destruction tcp_ao_info ceases to be\nwith RCU grace period, while tcp-ao static branch is currently deferred\ndestructed. The static key definition is\n: DEFINE_STATIC_KEY_DEFERRED_FALSE(tcp_ao_needed, HZ);\n\nwhich means that if RCU grace period is delayed by more than a second\nand tcp_ao_needed is in the process of disablement, other CPUs may\nyet see tcp_ao_info which atent dead, but soon-to-be.\nAnd that breaks the assumption of static_key_fast_inc_not_disabled().\n\nSee the comment near the definition:\n\u003e * The caller must make sure that the static key can't get disabled while\n\u003e * in this function. It doesn't patch jump labels, only adds a user to\n\u003e * an already enabled static key.\n\nOriginally it was introduced in commit eb8c507296f6 (\"jump_label:\nPrevent key-\u003eenabled int overflow\"), which is needed for the atomic\ncontexts, one of which would be the creation of a full socket from a\nrequest socket. In that atomic context, it's known by the presence\nof the key (md5/ao) that the static branch is already enabled.\nSo, the ref counter for that static branch is just incremented\ninstead of holding the proper mutex.\nstatic_key_fast_inc_not_disabled() is just a helper for such usage\ncase. But it must not be used if the static branch could get disabled\nin parallel as it's not protected by jump_label_mutex and as a result,\nraces with jump_label_update() implementation details.\n\nHappened on netdev test-bot[1], so not a theoretical issue:\n\n[] jump_label: Fatal kernel bug, unexpected op at tcp_inbound_hash+0x1a7/0x870 [ffffffffa8c4e9b7] (eb 50 0f 1f 44 != 66 90 0f 1f 00)) size:2 type:1\n[] ------------[ cut here ]------------\n[] kernel BUG at arch/x86/kernel/jump_label.c:73!\n[] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI\n[] CPU: 3 PID: 243 Comm: kworker/3:3 Not tainted 6.10.0-virtme #1\n[] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[] Workqueue: events jump_label_update_timeout\n[] RIP: 0010:__jump_label_patch+0x2f6/0x350\n...\n[] Call Trace:\n[]  \u003cTASK\u003e\n[]  arch_jump_label_transform_queue+0x6c/0x110\n[]  __jump_label_update+0xef/0x350\n[]  __static_key_slow_dec_cpuslocked.part.0+0x3c/0x60\n[]  jump_label_update_timeout+0x2c/0x40\n[]  process_one_work+0xe3b/0x1670\n[]  worker_thread+0x587/0xce0\n[]  kthread+0x28a/0x350\n[]  ret_from_fork+0x31/0x70\n[]  ret_from_fork_asm+0x1a/0x30\n[]  \u003c/TASK\u003e\n[] Modules linked in: veth\n[] ---[ end trace 0000000000000000 ]---\n[] RIP: 0010:__jump_label_patch+0x2f6/0x350\n\n[1]: https://netdev-3.bots.linux.dev/vmksft-tcp-ao-dbg/results/696681/5-connect-deny-ipv6/stderr","modified":"2026-04-02T12:18:26.811802Z","published":"2024-08-26T10:10:39.383Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43887.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/14ab4792ee120c022f276a7e4768f4dcb08f0cdd"},{"type":"WEB","url":"https://git.kernel.org/stable/c/954d55a59b2501f4a9bd693b40ce45a1c46cb2b3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43887.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43887"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"67fa83f7c86a86913ab9cd5a13b4bebd8d2ebb43"},{"fixed":"954d55a59b2501f4a9bd693b40ce45a1c46cb2b3"},{"fixed":"14ab4792ee120c022f276a7e4768f4dcb08f0cdd"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43887.json"}}],"schema_version":"1.7.5"}