CVE-2024-57849

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

s390/cpum_sf: Handle CPU hotplug remove during sampling

CPU hotplug remove handling triggers the following function

call sequence:

CPUHP_AP_PERF_S390_SF_ONLINE --> s390_pmu_sf_offline_cpu()

...

CPUHP_AP_PERF_ONLINE --> perf_event_exit_cpu()

The s390 CPUMF sampling CPU hotplug handler invokes:

s390_pmu_sf_offline_cpu()

+--> cpusf_pmu_setup()

+--> setup_pmc_cpu()

+--> deallocate_buffers()

This function de-allocates all sampling data buffers (SDBs) allocated

for that CPU at event initialization. It also clears the

PMU_F_RESERVED bit. The CPU is gone and can not be sampled.

With the event still being active on the removed CPU, the CPU event

hotplug support in kernel performance subsystem triggers the

following function calls on the removed CPU:

perf_event_exit_cpu()

+--> perf_event_exit_cpu_context()

+--> __perf_event_exit_context()

+--> __perf_remove_from_co

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References