Critical Null Pointer Dereference in Linux Kernel Eventfs - CVE-2024-46785
Summary
DEBIAN-CVE-2024-46785: In the Linux kernel, the following vulnerability has been resolved: eventfs: Use list_del_rcu() for SRCU protected list variable Chi Zhiling reported: We found a null pointer accessing in tracefs[1], the reason is that t... Affects linux versions < 6.10.11-1. Fixed in 6.10.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its robustness and versatility, supporting a wide range of hardware architectures. However, like any complex software, it is susceptible to vulnerabilities that can compromise system stability and security. This specific vulnerability affects the eventfs subsystem, which is responsible for managing event tracing in the kernel.
Vulnerability Detail
In the Linux kernel, a critical vulnerability has been identified in the eventfs subsystem, where a null pointer dereference can occur due to improper handling of a list variable. This issue arises when the variable 'ei_child' is set to LIST_POISON1, indicating that the list has been removed. Accessing 'ei_child->is_freed' subsequently triggers a kernel panic, leading to system instability. The vulnerability was reported by Chi Zhiling and can be exploited through specific kernel tracing operations, potentially resulting in a denial of service.
How To Fix
Minimum fixed version
6.10.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While waiting for the patch, users can implement a workaround by avoiding the use of the eventfs subsystem for tracing operations. Specifically, refrain from executing the following commands that may trigger the vulnerability: 'echo "p:kp submit_bio" > /sys/kernel/debug/tracing/kprobe_events' and 'echo "" > /sys/kernel/debug/tracing/kprobe_events'.
Conclusion
The CVE-2024-46785 vulnerability in the Linux kernel's eventfs subsystem poses a significant risk due to its potential to cause kernel panics. Users are strongly advised to update to the patched version of the Linux package to ensure system stability and security. In the meantime, implementing the suggested workarounds can help mitigate the risks associated with this vulnerability.
See every vulnerability recorded for linux →
FAQ
CVE-2024-46785 is a vulnerability in the Linux kernel's eventfs subsystem that can lead to a null pointer dereference and kernel panic.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Exploiting this vulnerability can lead to system crashes and denial of service, affecting the stability and availability of the affected systems.
Yes, a patch is available in version 6.10.11-1 of the Linux package. Updating to this version will resolve the vulnerability.
If immediate updates are not possible, avoid using the eventfs subsystem for tracing operations to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
