Executive Summary

This vulnerability exists in the Linux kernel's real-time mutex (rtmutex) implementation, specifically in the remove_waiter() function. The function incorrectly uses the current task instead of the waiter::task when removing a waiter from the queue during certain operations like proxy-lock rollback invoked from futex_requeue().

• The rbtree dequeue operation happens without holding the pi_lock of the waiter task.
• The pi_blocked_on state of the waiter task is not cleared, leaving a dangling pointer that could lead to use-after-free (UAF) issues.
• The priority adjustment function rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task.

The fix involves using waiter::task instead of current in all related operations within remove_waiter() to address these problems.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to incorrect handling of real-time mutex waiters in the Linux kernel, potentially causing system instability or unexpected behavior.

Specifically, the dangling pointer from the uncleared pi_blocked_on state could result in use-after-free conditions, which attackers might exploit to cause crashes or escalate privileges.

Additionally, incorrect priority adjustments could affect real-time task scheduling, leading to performance degradation or priority inversion issues.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is resolved by updating the Linux kernel to a version where the fix is applied. Specifically, the fix involves changing remove_waiter() to use waiter::task instead of current in all related operations.

Therefore, the immediate step to mitigate this vulnerability is to apply the latest Linux kernel update that includes this fix.

Useful 0 Not Useful 0