CVE-2024-46845

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tracing/timerlat: Only clear timer if a kthread exists

The timerlat tracer can use user space threads to check for osnoise and

timer latency. If the program using this is killed via a SIGTERM, the

threads are shutdown one at a time and another tracing instance can start

up resetting the threads before they are fully closed. That causes the

hrtimer assigned to the kthread to be shutdown and freed twice when the

dying thread finally closes the file descriptors, causing a use-after-free

bug.

Only cancel the hrtimer if the associated thread is still around. Also add

the interface_lock around the resetting of the tlat_var->kthread.

Note, this is just a quick fix that can be backported to stable. A real

fix is to have a better synchronization between the shutdown of old

threads and the starting of new ones.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References