CVE-2024-26703

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tracing/timerlat: Move hrtimer_init to timerlat_fd open()

Currently, the timerlat's hrtimer is initialized at the first read of

timerlat_fd, and destroyed at close(). It works, but it causes an error

if the user program open() and close() the file without reading.

Here's an example:

# echo NO_OSNOISE_WORKLOAD > /sys/kernel/debug/tracing/osnoise/options

# echo timerlat > /sys/kernel/debug/tracing/current_tracer

# cat <<EOF > ./timerlat_load.py

# !/usr/bin/env python3

timerlat_fd = open("/sys/kernel/tracing/osnoise/per_cpu/cpu0/timerlat_fd", 'r')

timerlat_fd.close();

EOF

# ./taskset -c 0 ./timerlat_load.py

<BOOM>

BUG: kernel NULL pointer dereference, address: 0000000000000010

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page

PGD 0 P4D 0

Oops: 0000 [#1] PREEMPT SMP NOPTI

CPU: 1 PID: 2673 Comm: python3 Not tainted 6.6.13-200.fc39.x86_64 #1

Hardware name: QEMU Stand

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References