CVE-2024-46788

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracing/osnoise: Use a cpumask to know what threads are kthreads

The start_kthread() and stop_thread() code was not always called with the

interface_lock held. This means that the kthread variable could be

unexpectedly changed causing the kthread_stop() to be called on it when it

should not have been, leading to:

while true; do

rtla timerlat top -u -q & PID=$!;

sleep 5;

kill -INT $PID;

sleep 0.001;

kill -TERM $PID;

wait $PID;

done

Causing the following OOPS:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI

KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]

CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 Not tainted 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254

Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014

RIP: 0010:hrtime

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References