CVE-2024-46845 (GCVE-0-2024-46845)
Vulnerability from cvelistv5
Published
2024-09-27 12:39
Modified
2026-08-05 11:38
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Only clear timer if a kthread exists The timerlat tracer can use user space threads to check for osnoise and timer latency. If the program using this is killed via a SIGTERM, the threads are shutdown one at a time and another tracing instance can start up resetting the threads before they are fully closed. That causes the hrtimer assigned to the kthread to be shutdown and freed twice when the dying thread finally closes the file descriptors, causing a use-after-free bug. Only cancel the hrtimer if the associated thread is still around. Also add the interface_lock around the resetting of the tlat_var->kthread. Note, this is just a quick fix that can be backported to stable. A real fix is to have a better synchronization between the shutdown of old threads and the starting of new ones.
References
Impacted products
Vendor Product Version
Linux Linux Version: e88ed227f639ebcb31ed4e5b88756b47d904584b
Version: e88ed227f639ebcb31ed4e5b88756b47d904584b
Version: e88ed227f639ebcb31ed4e5b88756b47d904584b
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46845",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T13:59:07.271021Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T13:59:12.034Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_osnoise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8c72f0b2c45f21cb8b00fc37f79f632d7e46c2ed",
              "status": "affected",
              "version": "e88ed227f639ebcb31ed4e5b88756b47d904584b",
              "versionType": "git"
            },
            {
              "lessThan": "8a9d0d405159e9c796ddf771f7cff691c1a2bc1e",
              "status": "affected",
              "version": "e88ed227f639ebcb31ed4e5b88756b47d904584b",
              "versionType": "git"
            },
            {
              "lessThan": "e6a53481da292d970d1edf0d8831121d1c5e2f0d",
              "status": "affected",
              "version": "e88ed227f639ebcb31ed4e5b88756b47d904584b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_osnoise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.51",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.10",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/timerlat: Only clear timer if a kthread exists\n\nThe timerlat tracer can use user space threads to check for osnoise and\ntimer latency. If the program using this is killed via a SIGTERM, the\nthreads are shutdown one at a time and another tracing instance can start\nup resetting the threads before they are fully closed. That causes the\nhrtimer assigned to the kthread to be shutdown and freed twice when the\ndying thread finally closes the file descriptors, causing a use-after-free\nbug.\n\nOnly cancel the hrtimer if the associated thread is still around. Also add\nthe interface_lock around the resetting of the tlat_var-\u003ekthread.\n\nNote, this is just a quick fix that can be backported to stable. A real\nfix is to have a better synchronization between the shutdown of old\nthreads and the starting of new ones."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through local file operations on tracefs (`open`/`read`/`close` on `osnoise/per_cpu/cpuN/timerlat_fd` plus writes to `current_tracer` and `osnoise/options`). There is no network or remote-peer input involved.\nAC:L - The attacker controls both sides of the race \u2014 they terminate their own timerlat user threads (which close fds one at a time, giving a wide window) while concurrently starting a second timerlat instance that memsets the still-armed per-cpu hrtimers, and can retry the loop indefinitely. CONFIG_TIMERLAT_TRACER is enabled in mainstream distro kernels, so no rare configuration is required.\nPR:L - Default tracefs permissions are root-only, but tracefs explicitly supports `uid=`/`gid=`/`mode=` mount options and it is common practice (Android tracing group, developer/CI/RT-tuning hosts, tracing sidecar containers with /sys/kernel/tracing mounted rw) to grant an unprivileged user or group full tracing access so rtla/trace-cmd can run without root; in that reasonable deployment a basic local user performs the whole sequence.\nUI:N - The attacker performs every step themselves \u2014 enabling the tracer, opening the per-cpu timerlat fds, killing the threads, and restarting a second instance. No victim action is needed.\nS:U - The corruption is confined to kernel hrtimer state within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The bug is an upstream-acknowledged use-after-free on an hrtimer that remains enqueued in the per-CPU hrtimer_clock_base rb-tree after being zeroed and re-initialized, giving corruption of timer-subsystem structures that can be groomed into arbitrary kernel-memory reads.\nI:H - A stale rb-node left in the hrtimer timerqueue with zeroed links causes subsequent `rb_insert_color`/`rb_erase` operations to write through attacker-influenceable pointers, and the freed/re-initialized timer\u0027s `function` field is a call target \u2014 a write and control-flow-hijack primitive.\nA:H - Even without full exploitation the bug reliably crashes the kernel: `hrtimer_cancel()` dereferences a NULL `timer-\u003ebase`, and the next hrtimer interrupt dequeues the zeroed node and calls a NULL `timer-\u003efunction` in hardirq context, panicking the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:38:57.813Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8c72f0b2c45f21cb8b00fc37f79f632d7e46c2ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a9d0d405159e9c796ddf771f7cff691c1a2bc1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6a53481da292d970d1edf0d8831121d1c5e2f0d"
        }
      ],
      "title": "tracing/timerlat: Only clear timer if a kthread exists",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46845",
    "datePublished": "2024-09-27T12:39:38.315Z",
    "dateReserved": "2024-09-11T15:12:18.289Z",
    "dateUpdated": "2026-08-05T11:38:57.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46845\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T13:59:07.271021Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T13:59:08.464Z\"}}], \"cna\": {\"title\": \"tracing/timerlat: Only clear timer if a kthread exists\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e88ed227f639ebcb31ed4e5b88756b47d904584b\", \"lessThan\": \"8c72f0b2c45f21cb8b00fc37f79f632d7e46c2ed\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e88ed227f639ebcb31ed4e5b88756b47d904584b\", \"lessThan\": \"8a9d0d405159e9c796ddf771f7cff691c1a2bc1e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e88ed227f639ebcb31ed4e5b88756b47d904584b\", \"lessThan\": \"e6a53481da292d970d1edf0d8831121d1c5e2f0d\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/trace/trace_osnoise.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.51\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/trace/trace_osnoise.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8c72f0b2c45f21cb8b00fc37f79f632d7e46c2ed\"}, {\"url\": \"https://git.kernel.org/stable/c/8a9d0d405159e9c796ddf771f7cff691c1a2bc1e\"}, {\"url\": \"https://git.kernel.org/stable/c/e6a53481da292d970d1edf0d8831121d1c5e2f0d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing/timerlat: Only clear timer if a kthread exists\\n\\nThe timerlat tracer can use user space threads to check for osnoise and\\ntimer latency. If the program using this is killed via a SIGTERM, the\\nthreads are shutdown one at a time and another tracing instance can start\\nup resetting the threads before they are fully closed. That causes the\\nhrtimer assigned to the kthread to be shutdown and freed twice when the\\ndying thread finally closes the file descriptors, causing a use-after-free\\nbug.\\n\\nOnly cancel the hrtimer if the associated thread is still around. Also add\\nthe interface_lock around the resetting of the tlat_var-\u003ekthread.\\n\\nNote, this is just a quick fix that can be backported to stable. A real\\nfix is to have a better synchronization between the shutdown of old\\nthreads and the starting of new ones.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.51\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.10\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:35:47.670Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46845\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:35:47.670Z\", \"dateReserved\": \"2024-09-11T15:12:18.289Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-27T12:39:38.315Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.