Critical Use-After-Free Vulnerability in Linux Kernel Affecting CPU Hotplug Handling
Summary
CVE-2024-57849: In the Linux kernel, the following vulnerability has been resolved: s390/cpum_sf: Handle CPU hotplug remove during sampling CPU hotplug remove handling triggers the following function call sequence: CPUHP_AP_PERF_S390_SF... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system, including process management, memory management, and device control. The kernel is crucial for system stability and performance. This vulnerability specifically affects the CPU hotplug functionality, which allows CPUs to be added or removed from the system dynamically. The vulnerability arises during the handling of CPU hotplug removal, leading to potential instability and security risks.
Vulnerability Detail
In the Linux kernel, a use-after-free vulnerability occurs during the CPU hotplug removal process. When a CPU is removed, the sampling data buffers (SDBs) associated with it are deallocated. However, if an event is still active on the removed CPU, the kernel attempts to access these freed buffers to read remaining samples. This can lead to accessing invalid memory, resulting in undefined behavior, potential system crashes, or exploitation by malicious actors. The vulnerability is triggered by the sequence of function calls that do not properly check the state of the CPU before accessing the SDBs.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
The CVE-2024-57849 vulnerability in the Linux kernel presents a significant risk related to CPU hotplug handling. It is crucial for users and administrators to update their systems to the patched versions to mitigate potential threats. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in real-time, ensuring better security for your applications.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory location after it has been freed, potentially leading to crashes or security breaches.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
The consequences can range from system instability and crashes to potential exploitation by attackers, leading to unauthorized access or data breaches.
Yes, the vulnerability affects various versions of the Linux kernel across Debian 11, 12, and 13, with specific fixed versions available.
It is recommended to regularly check for updates and apply them promptly to ensure that your system is protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
