CVE-2024-38601

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix a race between readers and resize checks

The reader code in rb_get_reader_page() swaps a new reader page into the

ring buffer by doing cmpxchg on old->list.prev->next to point it to the

new page. Following that, if the operation is successful,

old->list.next->prev gets updated too. This means the underlying

doubly-linked list is temporarily inconsistent, page->prev->next or

page->next->prev might not be equal back to page for some page in the

ring buffer.

The resize operation in ring_buffer_resize() can be invoked in parallel.

It calls rb_check_pages() which can detect the described inconsistency

and stop further tracing:

[ 190.271762] ------------[ cut here ]------------

[ 190.271771] WARNING: CPU: 1 PID: 6186 at kernel/trace/ring_buffer.c:1467 rb_check_pages.isra.0+0x6a/0xa0

[ 190.271789] Modules linked in: [...]

[ 190.271991] Unloaded tainted modules: intel_uncore_frequency(E):1 skx_edac(E):

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References