Google: sys-kernel/lakitu-kernel-6_6: security update to 18964.0.0

medium Tenable Cloud Security Plugin ID 452797

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock when freeing cgroup
storage The following commit bc235cdb423a ("bpf: Prevent deadlock from recursive
bpf_task_storage_[get|delete]") first introduced deadlock prevention for fentry/fexit programs attaching
on bpf_task_storage helpers. That commit also employed the logic in map free path in its v6 version. Later
bpf_cgrp_storage was first introduced in c4bcfb38a95e ("bpf: Implement cgroup storage available to non-
cgroup-attached bpf progs") which faces the same issue as bpf_task_storage, instead of its busy counter,
NULL was passed to bpf_local_storage_map_free() which opened a window to cause deadlock: <TASK> (acquiring
local_storage->lock) _raw_spin_lock_irqsave+0x3d/0x50 bpf_local_storage_update+0xd1/0x460
bpf_cgrp_storage_get+0x109/0x130 bpf_prog_a4d4a370ba857314_cgrp_ptr+0x139/0x170 ?
__bpf_prog_enter_recur+0x16/0x80 bpf_trampoline_6442485186+0x43/0xa4 cgroup_storage_ptr+0x9/0x20 (holding
local_storage->lock) bpf_selem_unlink_storage_nolock.constprop.0+0x135/0x160
bpf_selem_unlink_storage+0x6f/0x110 bpf_local_storage_map_free+0xa2/0x110 bpf_map_free_deferred+0x5b/0x90
process_one_work+0x17c/0x390 worker_thread+0x251/0x360 kthread+0xd2/0x100 ret_from_fork+0x34/0x50
ret_from_fork_asm+0x1a/0x30 </TASK> Progs: - A: SEC("fentry/cgroup_storage_ptr") - cgid
(BPF_MAP_TYPE_HASH) Record the id of the cgroup the current task belonging to in this hash map, using the
address of the cgroup as the map key. - cgrpa (BPF_MAP_TYPE_CGRP_STORAGE) If current task is a kworker,
lookup the above hash map using function parameter @owner as the key to get its corresponding cgroup id
which is then used to get a trusted pointer to the cgroup through bpf_cgroup_from_id(). This trusted
pointer can then be passed to bpf_cgrp_storage_get() to finally trigger the deadlock issue. - B:
SEC("tp_btf/sys_enter") - cgrpb (BPF_MAP_TYPE_CGRP_STORAGE) The only purpose of this prog is to fill Prog
A's hash map by calling bpf_cgrp_storage_get() for as many userspace tasks as possible. Steps to
reproduce: - Run A; - while (true) { Run B; Destroy B; } Fix this issue by passing its busy counter to the
free procedure so it can be properly incremented before storage/smap locking. (CVE-2024-58088)

Solution

Update the sys-kernel/lakitu-kernel-6_6 library and its related packages to version 18964.0.0 or later.

Plugin Details

Severity: Medium

ID: 452797

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2024-58088

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 3/12/2025

Reference Information

CVE: CVE-2024-58088

Detections

Analytics