CVE-2024-56739

A vulnerability was found in the Linux kernel's RTC driver in the rtc_timer_do_work() function, where the __rtc_read_time call may fail. This issue results in uninitialized data in the rtc_time struct. It can lead to the generation of extremely large values, causing periodic timer failures and potentially triggering a kernel softlockup, impacting system stability.

Red Hat Enterprise Linux 9 is affected by this moderate-impact Linux kernel vulnerability in the RTC (real-time clock) subsystem. The rtc_timer_do_work() function does not check whether the __rtc_read_time() call succeeded, so after a failed RTC read the rtc_time structure may contain uninitialized data or an illegal date/time read from the RTC hardware. Converting such a value with rtc_tm_to_ktime() can produce a very large expiry time (possibly KTIME_MAX), causing periodic timers in the RTC timer queue to expire continually and potentially resulting in a kernel soft lockup, a local denial of service that affects system availability only, with no impact on confidentiality or integrity. The Red Hat severity of Moderate (CVSS 3.1 score 5.5, vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is consistent with the upstream NIST assessment. For the affected Red Hat Enterprise Linux 9 kernel, a fix is being pursued through the delegated maintenance process; the affected RHEL 9 kernel-rt stream is currently not scheduled to be fixed. Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 10 are not affected because the vulnerable code is not present in those releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.