CVE-2024-50210

What it actually does

Unbalanced read lock on clk->rwsem and missing fput on the clock fd in the error path of pc_clock_settime after get_clock_desc succeeds, allowing a local process to trigger resource imbalance or deadlock in the posix-clock subsystem.

Why it matters to the business

Local users on affected Linux systems can cause kernel-level hangs or crashes that disrupt services, with elevated urgency for organizations running large fleets of Linux servers or containers due to the kernel's widespread use and the presence of related Linux kernel issues in observed espionage and financially motivated campaigns.

How an attack unfolds

An attacker with local access crafts a call to clock_settime with an invalid timespec, triggering the unbalanced lock path; repeated or concurrent invocations by espionage or financially motivated actors can exhaust resources or deadlock the clock subsystem leading to denial of service.

How to fix it

Update the Linux kernel to commit f40ddce88593482919761f74910f42f4b84c004b or later; rebuild and reboot with the patched kernel; apply distribution backports where available.

How to confirm the fix worked

Confirm the running kernel contains commit f40ddce88593482919761f74910f42f4b84c004b via git log or version string; exercise clock_settime with invalid timespec values and verify no lock imbalance or oops occurs in dmesg.

Typical attack path

1. Obtain local shell or process execution on target Linux system
2. Open a valid posix clock fd and prepare an invalid timespec64 value
3. Invoke clock_settime to enter pc_clock_settime and hit the unbalanced error path
4. Repeat or race the call to induce lock imbalance or system hang

How to detect it

Inspect kernel logs for oops or warning messages around posix-clock or clock_settime; correlate with process activity calling clock syscalls; review for repeated failed clock_settime attempts from the same user or process.

What your security team should do

• Immediately schedule kernel upgrades to the fixed commit across all Linux assets
• Monitor for local privilege or stability issues on systems that cannot be patched quickly
• Review and restrict local user access to clock-related syscalls where feasible