Critical Performance Issue in Linux Kernel: CVE-2024-46848
Summary
CVE-2024-46848: In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Limit the period on Haswell Running the ltp test cve-2015-3290 concurrently reports the following warnings. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It provides essential services for all other parts of the operating system and is crucial for system stability and performance. This vulnerability affects multiple Debian versions (11, 12, and 13) and is related to performance monitoring features, specifically in Intel's Haswell architecture.
Vulnerability Detail
CVE-2024-46848 is a performance-related vulnerability in the Linux kernel that arises from a low initial period setting in the frequency estimation algorithm. This issue can lead to warnings such as 'irq loop stuck!' during concurrent execution of specific tests. The root cause is linked to hardware errata HSW11 and HSW143, which can result in incorrect performance monitoring and system instability. The erratum HSW11 requires a minimum period of 100 for certain events, while HSW143 indicates potential overcounting issues with Hyper-Threading enabled. The vulnerability can lead to performance degradation and system crashes if not addressed.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually adjust the performance monitoring settings to enforce a minimum period of 128 for the INST_RETIRED.ALL event and 32 for other events. However, this workaround may not fully mitigate the issue and should not replace an official patch.
Conclusion
CVE-2024-46848 is a significant vulnerability in the Linux kernel that affects performance monitoring on Intel's Haswell architecture. Users are advised to update their systems promptly to mitigate potential risks associated with this issue.
See every vulnerability recorded for linux →
FAQ
CVE-2024-46848 is a vulnerability in the Linux kernel related to performance monitoring on Intel's Haswell architecture, which can lead to system instability.
Debian versions 11, 12, and 13 are affected by this vulnerability.
The vulnerability can cause performance degradation, system crashes, and incorrect performance monitoring results.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Yes, the permanent fix is to update the Linux kernel to the latest version that addresses CVE-2024-46848.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
