CVE-2024-44959

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracefs: Use generic inode RCU for synchronizing freeing

With structure layout randomization enabled for 'struct inode' we need to

avoid overlapping any of the RCU-used / initialized-only-once members,

e.g. i_lru or i_sb_list to not corrupt related list traversals when making

use of the rcu_head.

For an unlucky structure layout of 'struct inode' we may end up with the

following splat when running the ftrace selftests:

[<...>] list_del corruption, ffff888103ee2cb0->next (tracefs_inode_cache+0x0/0x4e0 [slab object]) is NULL (prev is tracefs_inode_cache+0x78/0x4e0 [slab object])

[<...>] ------------[ cut here ]------------

[<...>] kernel BUG at lib/list_debug.c:54!

[<...>] invalid opcode: 0000 [#1] PREEMPT SMP KASAN

[<...>] CPU: 3 PID: 2550 Comm: mount Tainted: G N 6.8.12-grsec+ #122 ed2f536ca62f28b087b90e3cc906a8d25b3ddc65

[<...>] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References