🇰🇷 한글 설명
Linux 커널의 스케줄러(sched/fair)에서 프로세스 복제(fork) 시 sched_entity의 rel_deadline 값이 초기화되지 않아 발생하는 취약점입니다. 이로 인해 잘못된 vruntime 값이 계산되어 정수 오버플로가 발생하며, 결과적으로 커널 패닉이나 NULL 포인터 역참조로 인한 시스템 충돌을 유발할 수 있습니다.
💡 쉬운 설명
새로운 프로세스를 만들 때 이전 프로세스의 잘못된 시간 정보가 그대로 전달되어 컴퓨터의 계산 오류를 일으킵니다. 이 오류가 쌓이면 시스템이 갑자기 멈추거나 꺼질 수 있습니다.
🇺🇸 원문 (English)
In the Linux kernel, the following vulnerability has been resolved:
sched/fair: Clear rel_deadline when initializing forked entities
A yield-triggered crash can happen when a newly forked sched_entity
enters the fair class with se->rel_deadline unexpectedly set.
The failing sequence is:
1. A task is forked while se->rel_deadline is still set.
2. __sched_fork() initializes vruntime, vlag and other sched_entity
state, but does not clear rel_deadline.
3. On the first enqueue, enqueue_entity() calls place_entity().
4. Because se->rel_deadline is set, place_entity() treats se->deadline
as a relative deadline and converts it to an absolute deadline by
adding the current vruntime.
5. However, the forked entity's deadline is not a valid inherited
relative deadline for this new scheduling instance, so the conversion
produces an abnormally large deadline.
6. If the task later calls sched_yield(), yield_task_fair() advances
se->vruntime to se->deadline.
7. The inflated vruntime is then used by the following enqueue path,
where the vruntime-derived key can overflow when multiplied by the
entity weight.
8. This corrupts cfs_rq->sum_w_vruntime, breaks EEVDF eligibility
calculation, and can eventually make all entities appear ineligible.
pick_next_entity() may then return NULL unexpectedly, leading to a
later NULL dereference.
A captured trace shows the effect clearly. Before yield, the entity's
vruntime was around:
9834017729983308
After yield_task_fair() executed:
se->vruntime = se->deadline
the vruntime jumped to:
19668035460670230
and the deadline was later advanced further to:
19668035463470230
This shows that the deadline had already become abnormally large before
yield_task_fair() copied it into vruntime.
rel_deadline is only meaningful when se->deadline really carries a
relative deadline that still needs to be placed against vruntime. A
freshly forked sched_entity should not inherit or retain this state.
Clear se->rel_deadline in __sched_fork(), together with the other
sched_entity runtime state, so that the first enqueue does not interpret
the new entity's deadline as a stale relative deadline.
📍 영향받는 시스템
Linux Kernel (sched/fair 관련 모듈을 사용하는 버전)
⚔️ 공격 벡터
특정 스케줄링 조건(sched_yield 호출 등)을 유도하여 커널 내 정수 오버플로 및 NULL dereference 유발
🛡️ 대응 방법
Linux 커널을 최신 보안 패치가 적용된 버전으로 업데이트하여 __sched_fork() 함수 내 rel_deadline 초기화 로직을 적용해야 함
🔧 검증 코드
출력된 커널 버전을 확인하여 해당 취약점이 해결된 패치 버전인지 배포판 보안 공지를 통해 대조함