CVE-2024-46788 (GCVE-0-2024-46788)

Vulnerability from cvelistv5 – Published: 2024-09-18 07:12 – Updated: 2026-08-05 11:38
VLAI
Title
tracing/osnoise: Use a cpumask to know what threads are kthreads
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Use a cpumask to know what threads are kthreads The start_kthread() and stop_thread() code was not always called with the interface_lock held. This means that the kthread variable could be unexpectedly changed causing the kthread_stop() to be called on it when it should not have been, leading to: while true; do rtla timerlat top -u -q & PID=$!; sleep 5; kill -INT $PID; sleep 0.001; kill -TERM $PID; wait $PID; done Causing the following OOPS: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 Not tainted 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:hrtimer_active+0x58/0x300 Code: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 <0f> b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f RSP: 0018:ffff88811d97f940 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28 RBP: 0000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60 R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28 FS: 0000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0 Call Trace: <TASK> ? die_addr+0x40/0xa0 ? exc_general_protection+0x154/0x230 ? asm_exc_general_protection+0x26/0x30 ? hrtimer_active+0x58/0x300 ? __pfx_mutex_lock+0x10/0x10 ? __pfx_locks_remove_file+0x10/0x10 hrtimer_cancel+0x15/0x40 timerlat_fd_release+0x8e/0x1f0 ? security_file_release+0x43/0x80 __fput+0x372/0xb10 task_work_run+0x11e/0x1f0 ? _raw_spin_lock+0x85/0xe0 ? __pfx_task_work_run+0x10/0x10 ? poison_slab_object+0x109/0x170 ? do_exit+0x7a0/0x24b0 do_exit+0x7bd/0x24b0 ? __pfx_migrate_enable+0x10/0x10 ? __pfx_do_exit+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x64/0x140 ? _raw_spin_lock_irq+0x86/0xe0 do_group_exit+0xb0/0x220 get_signal+0x17ba/0x1b50 ? vfs_read+0x179/0xa40 ? timerlat_fd_read+0x30b/0x9d0 ? __pfx_get_signal+0x10/0x10 ? __pfx_timerlat_fd_read+0x10/0x10 arch_do_signal_or_restart+0x8c/0x570 ? __pfx_arch_do_signal_or_restart+0x10/0x10 ? vfs_read+0x179/0xa40 ? ksys_read+0xfe/0x1d0 ? __pfx_ksys_read+0x10/0x10 syscall_exit_to_user_mode+0xbc/0x130 do_syscall_64+0x74/0x110 ? __pfx___rseq_handle_notify_resume+0x10/0x10 ? __pfx_ksys_read+0x10/0x10 ? fpregs_restore_userregs+0xdb/0x1e0 ? fpregs_restore_userregs+0xdb/0x1e0 ? syscall_exit_to_user_mode+0x116/0x130 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 entry_SYSCALL_64_after_hwframe+0x71/0x79 RIP: 0033:0x7ff0070eca9c Code: Unable to access opcode bytes at 0x7ff0070eca72. RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003 RBP: 00007ff006dffde0 R08: 0000000000000000 R09: 00007ff000000ba0 R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003 R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008 </TASK> Modules linked in: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core ---[ end trace 0000000000000000 ]--- This is because it would mistakenly call kthread_stop() on a user space thread making it "exit" before it actually exits. Since kthread ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e88ed227f639ebcb31ed4e5b88756b47d904584b , < 7a5f01828edf152c144d27cf63de446fdf2dc222 (git)
Affected: e88ed227f639ebcb31ed4e5b88756b47d904584b , < 27282d2505b402f39371fd60d19d95c01a4b6776 (git)
Affected: e88ed227f639ebcb31ed4e5b88756b47d904584b , < 177e1cc2f41235c145041eed03ef5bab18f32328 (git)
Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.51 , ≤ 6.6.* (semver)
Unaffected: 6.10.10 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46788",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T14:28:37.138959Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T14:28:52.086Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_osnoise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7a5f01828edf152c144d27cf63de446fdf2dc222",
              "status": "affected",
              "version": "e88ed227f639ebcb31ed4e5b88756b47d904584b",
              "versionType": "git"
            },
            {
              "lessThan": "27282d2505b402f39371fd60d19d95c01a4b6776",
              "status": "affected",
              "version": "e88ed227f639ebcb31ed4e5b88756b47d904584b",
              "versionType": "git"
            },
            {
              "lessThan": "177e1cc2f41235c145041eed03ef5bab18f32328",
              "status": "affected",
              "version": "e88ed227f639ebcb31ed4e5b88756b47d904584b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_osnoise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.51",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.10",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/osnoise: Use a cpumask to know what threads are kthreads\n\nThe start_kthread() and stop_thread() code was not always called with the\ninterface_lock held. This means that the kthread variable could be\nunexpectedly changed causing the kthread_stop() to be called on it when it\nshould not have been, leading to:\n\n while true; do\n   rtla timerlat top -u -q \u0026 PID=$!;\n   sleep 5;\n   kill -INT $PID;\n   sleep 0.001;\n   kill -TERM $PID;\n   wait $PID;\n  done\n\nCausing the following OOPS:\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 Not tainted 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n RIP: 0010:hrtimer_active+0x58/0x300\n Code: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 \u003c0f\u003e b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f\n RSP: 0018:ffff88811d97f940 EFLAGS: 00010202\n RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b\n RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28\n RBP: 0000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60\n R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d\n R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28\n FS:  0000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0\n Call Trace:\n  \u003cTASK\u003e\n  ? die_addr+0x40/0xa0\n  ? exc_general_protection+0x154/0x230\n  ? asm_exc_general_protection+0x26/0x30\n  ? hrtimer_active+0x58/0x300\n  ? __pfx_mutex_lock+0x10/0x10\n  ? __pfx_locks_remove_file+0x10/0x10\n  hrtimer_cancel+0x15/0x40\n  timerlat_fd_release+0x8e/0x1f0\n  ? security_file_release+0x43/0x80\n  __fput+0x372/0xb10\n  task_work_run+0x11e/0x1f0\n  ? _raw_spin_lock+0x85/0xe0\n  ? __pfx_task_work_run+0x10/0x10\n  ? poison_slab_object+0x109/0x170\n  ? do_exit+0x7a0/0x24b0\n  do_exit+0x7bd/0x24b0\n  ? __pfx_migrate_enable+0x10/0x10\n  ? __pfx_do_exit+0x10/0x10\n  ? __pfx_read_tsc+0x10/0x10\n  ? ktime_get+0x64/0x140\n  ? _raw_spin_lock_irq+0x86/0xe0\n  do_group_exit+0xb0/0x220\n  get_signal+0x17ba/0x1b50\n  ? vfs_read+0x179/0xa40\n  ? timerlat_fd_read+0x30b/0x9d0\n  ? __pfx_get_signal+0x10/0x10\n  ? __pfx_timerlat_fd_read+0x10/0x10\n  arch_do_signal_or_restart+0x8c/0x570\n  ? __pfx_arch_do_signal_or_restart+0x10/0x10\n  ? vfs_read+0x179/0xa40\n  ? ksys_read+0xfe/0x1d0\n  ? __pfx_ksys_read+0x10/0x10\n  syscall_exit_to_user_mode+0xbc/0x130\n  do_syscall_64+0x74/0x110\n  ? __pfx___rseq_handle_notify_resume+0x10/0x10\n  ? __pfx_ksys_read+0x10/0x10\n  ? fpregs_restore_userregs+0xdb/0x1e0\n  ? fpregs_restore_userregs+0xdb/0x1e0\n  ? syscall_exit_to_user_mode+0x116/0x130\n  ? do_syscall_64+0x74/0x110\n  ? do_syscall_64+0x74/0x110\n  ? do_syscall_64+0x74/0x110\n  entry_SYSCALL_64_after_hwframe+0x71/0x79\n RIP: 0033:0x7ff0070eca9c\n Code: Unable to access opcode bytes at 0x7ff0070eca72.\n RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\n RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c\n RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003\n RBP: 00007ff006dffde0 R08: 0000000000000000 R09: 00007ff000000ba0\n R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003\n R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008\n  \u003c/TASK\u003e\n Modules linked in: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core\n ---[ end trace 0000000000000000 ]---\n\nThis is because it would mistakenly call kthread_stop() on a user space\nthread making it \"exit\" before it actually exits.\n\nSince kthread\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached entirely through local file operations on tracefs \u2014 writes to `current_tracer`/`osnoise/options`/`osnoise/cpus` and open/read/close of `osnoise/per_cpu/cpuN/timerlat_fd` \u2014 plus signals to the attacker\u0027s own threads. There is no remote or adjacent-network path.\nAC:L - The attacker controls both sides of the race: one set of threads holds `timerlat_fd` open while another thread toggles the tracer/`OSN_WORKLOAD` option and delivers SIGINT/SIGTERM, and the upstream reproducer is a trivial `while true` shell loop that crashes the kernel within seconds. No condition beyond the attacker\u0027s control is required, and the needed `CONFIG_TIMERLAT_TRACER` is enabled in mainstream distribution kernels.\nPR:L - The code path contains no `capable()`/CAP_SYS_ADMIN or LSM check whatsoever \u2014 the only gate is tracefs file permissions (`0640` write / `0440` read), and tracefs supports `gid=`/`mode=` mount options that RT/HPC hosts running `rtla`, Android/Perfetto trace collectors, and ChromeOS commonly use to grant tracing to an unprivileged group. In such standard deployments an ordinary unprivileged user in that group can perform every step of the attack.\nUI:N - The attacker\u0027s own processes perform all the required actions \u2014 opening timerlat_fd, flipping the tracer option, and signalling their own threads. No victim interaction of any kind is needed.\nS:U - The corruption is confined to kernel objects (`task_struct`, `struct kthread`, per-CPU timerlat hrtimer state) within the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Calling `kthread_stop()` on a user task plus the unsynchronized `put_task_struct()`/`kthread` clearing produces a `task_struct` refcount underflow and use-after-free (confirmed by the sibling fixes 5bfbcd1ee57b and e6a53481da29 for the same regression). A UAF lets the attacker reclaim the freed slab object with controlled data and read back kernel memory, giving high confidentiality impact.\nI:H - The same premature-free condition yields a write primitive: freed `task_struct`/`kthread`/hrtimer objects are reused while stale kernel paths (`set_bit(KTHREAD_SHOULD_STOP, ...)`, `hrtimer_cancel()`, completion wakeups) still write through them, enabling heap grooming and control-flow hijack. Use-after-free of scheduler-adjacent structures is a high-integrity impact.\nA:H - The bug reproducibly produces a kernel oops \u2014 the upstream report shows a general protection fault in `hrtimer_active()` from `timerlat_fd_release()`, and `kthread_stop()` on a user task additionally dereferences a NULL `worker_private`. It can be triggered repeatedly in a loop, panicking the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:38:34.219Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7a5f01828edf152c144d27cf63de446fdf2dc222"
        },
        {
          "url": "https://git.kernel.org/stable/c/27282d2505b402f39371fd60d19d95c01a4b6776"
        },
        {
          "url": "https://git.kernel.org/stable/c/177e1cc2f41235c145041eed03ef5bab18f32328"
        }
      ],
      "title": "tracing/osnoise: Use a cpumask to know what threads are kthreads",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46788",
    "datePublished": "2024-09-18T07:12:44.352Z",
    "dateReserved": "2024-09-11T15:12:18.278Z",
    "dateUpdated": "2026-08-05T11:38:34.219Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46788",
      "date": "2026-08-06",
      "epss": "0.00214",
      "percentile": "0.11868"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.5\", \"versionEndExcluding\": \"6.6.51\", \"matchCriteriaId\": \"68960B54-63EE-43D7-A875-28E3ECFA945B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.10\", \"matchCriteriaId\": \"ACDEE48C-137A-4731-90D0-A675865E1BED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0005AEF-856E-47EB-BFE4-90C46899394D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"39889A68-6D34-47A6-82FC-CD0BF23D6754\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing/osnoise: Use a cpumask to know what threads are kthreads\\n\\nThe start_kthread() and stop_thread() code was not always called with the\\ninterface_lock held. This means that the kthread variable could be\\nunexpectedly changed causing the kthread_stop() to be called on it when it\\nshould not have been, leading to:\\n\\n while true; do\\n   rtla timerlat top -u -q \u0026 PID=$!;\\n   sleep 5;\\n   kill -INT $PID;\\n   sleep 0.001;\\n   kill -TERM $PID;\\n   wait $PID;\\n  done\\n\\nCausing the following OOPS:\\n\\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI\\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\\n CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 Not tainted 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254\\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n RIP: 0010:hrtimer_active+0x58/0x300\\n Code: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 \u003c0f\u003e b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f\\n RSP: 0018:ffff88811d97f940 EFLAGS: 00010202\\n RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b\\n RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28\\n RBP: 0000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60\\n R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d\\n R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28\\n FS:  0000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000\\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0\\n Call Trace:\\n  \u003cTASK\u003e\\n  ? die_addr+0x40/0xa0\\n  ? exc_general_protection+0x154/0x230\\n  ? asm_exc_general_protection+0x26/0x30\\n  ? hrtimer_active+0x58/0x300\\n  ? __pfx_mutex_lock+0x10/0x10\\n  ? __pfx_locks_remove_file+0x10/0x10\\n  hrtimer_cancel+0x15/0x40\\n  timerlat_fd_release+0x8e/0x1f0\\n  ? security_file_release+0x43/0x80\\n  __fput+0x372/0xb10\\n  task_work_run+0x11e/0x1f0\\n  ? _raw_spin_lock+0x85/0xe0\\n  ? __pfx_task_work_run+0x10/0x10\\n  ? poison_slab_object+0x109/0x170\\n  ? do_exit+0x7a0/0x24b0\\n  do_exit+0x7bd/0x24b0\\n  ? __pfx_migrate_enable+0x10/0x10\\n  ? __pfx_do_exit+0x10/0x10\\n  ? __pfx_read_tsc+0x10/0x10\\n  ? ktime_get+0x64/0x140\\n  ? _raw_spin_lock_irq+0x86/0xe0\\n  do_group_exit+0xb0/0x220\\n  get_signal+0x17ba/0x1b50\\n  ? vfs_read+0x179/0xa40\\n  ? timerlat_fd_read+0x30b/0x9d0\\n  ? __pfx_get_signal+0x10/0x10\\n  ? __pfx_timerlat_fd_read+0x10/0x10\\n  arch_do_signal_or_restart+0x8c/0x570\\n  ? __pfx_arch_do_signal_or_restart+0x10/0x10\\n  ? vfs_read+0x179/0xa40\\n  ? ksys_read+0xfe/0x1d0\\n  ? __pfx_ksys_read+0x10/0x10\\n  syscall_exit_to_user_mode+0xbc/0x130\\n  do_syscall_64+0x74/0x110\\n  ? __pfx___rseq_handle_notify_resume+0x10/0x10\\n  ? __pfx_ksys_read+0x10/0x10\\n  ? fpregs_restore_userregs+0xdb/0x1e0\\n  ? fpregs_restore_userregs+0xdb/0x1e0\\n  ? syscall_exit_to_user_mode+0x116/0x130\\n  ? do_syscall_64+0x74/0x110\\n  ? do_syscall_64+0x74/0x110\\n  ? do_syscall_64+0x74/0x110\\n  entry_SYSCALL_64_after_hwframe+0x71/0x79\\n RIP: 0033:0x7ff0070eca9c\\n Code: Unable to access opcode bytes at 0x7ff0070eca72.\\n RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\\n RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c\\n RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003\\n RBP: 00007ff006dffde0 R08: 0000000000000000 R09: 00007ff000000ba0\\n R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003\\n R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008\\n  \u003c/TASK\u003e\\n Modules linked in: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core\\n ---[ end trace 0000000000000000 ]---\\n\\nThis is because it would mistakenly call kthread_stop() on a user space\\nthread making it \\\"exit\\\" before it actually exits.\\n\\nSince kthread\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracing/osnoise: Utilizar una cpumask para saber qu\\u00e9 subprocesos son kthreads El c\\u00f3digo start_kthread() y stop_thread() no siempre se llamaba con el interface_lock mantenido. Esto significa que la variable kthread podr\\u00eda cambiar inesperadamente provocando que se llamara a kthread_stop() en ella cuando no deber\\u00eda haberse hecho, lo que lleva a: while true; do rtla timerlat top -u -q \u0026amp; PID=$!; sleep 5; kill -INT $PID; sleep 0.001; kill -TERM $PID; wait $PID; hecho Provocando el siguiente OOPS: Oops: error de protecci\\u00f3n general, probablemente para la direcci\\u00f3n no can\\u00f3nica 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref en el rango [0x000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 No contaminado 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254 Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 01/04/2014 RIP: 0010:hrtimer_active+0x58/0x300 C\\u00f3digo: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 \u0026lt;0f\u0026gt; b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f RSP: 0018:ffff88811d97f940 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28 RBP: 000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60 R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28 FS: 000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0 Llamada Rastro:  ? die_addr+0x40/0xa0 ? exc_general_protection+0x154/0x230 ? asm_exc_general_protection+0x26/0x30 ? hrtimer_active+0x58/0x300 ? __pfx_mutex_lock+0x10/0x10 ? __pfx_locks_remove_file+0x10/0x10 hrtimer_cancel+0x15/0x40 timerlat_fd_release+0x8e/0x1f0 ? security_file_release+0x43/0x80 __fput+0x372/0xb10 task_work_run+0x11e/0x1f0 ? _raw_spin_lock+0x85/0xe0 ? __pfx_task_work_run+0x10/0x10 ? objeto poison_slab+0x109/0x170 ? do_exit+0x7a0/0x24b0 do_exit+0x7bd/0x24b0 ? __pfx_migrate_enable+0x10/0x10 ? __pfx_do_exit+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x64/0x140 ? _raw_spin_lock_irq+0x86/0xe0 do_group_exit+0xb0/0x220 obtener_se\\u00f1al+0x17ba/0x1b50 ? vfs_read+0x179/0xa40 ? timerlat_fd_read+0x30b/0x9d0 ? __pfx_get_signal+0x10/0x10 ? __pfx_timerlat_fd_read+0x10/0x10 arch_do_signal_or_restart+0x8c/0x570 ? __pfx_arch_do_signal_or_restart+0x10/0x10 ? vfs_read+0x179/0xa40 ? ksys_read+0xfe/0x1d0 ? __pfx_ksys_read+0x10/0x10 syscall_salir_al_modo_usuario+0xbc/0x130 do_syscall_64+0x74/0x110 ? __pfx___rseq_handle_notify_resume+0x10/0x10 ? __pfx_ksys_read+0x10/0x10 ? fpregs_restore_userregs+0xdb/0x1e0 ? fpregs_restore_userregs+0xdb/0x1e0 ? syscall_salir_al_modo_usuario+0x116/0x130 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 entry_SYSCALL_64_after_hwframe+0x71/0x79 RIP: 0033:0x7ff0070eca9c C\\u00f3digo: No se puede acceder a los bytes del c\\u00f3digo de operaci\\u00f3n en 0x7ff0070eca72. RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003 RBP: 00007ff006dffde0 R08: 000000000000000 R09: 00007ff000000ba0 R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003 R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008  M\\u00f3dulos vinculados en: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core ---[ fin del seguimiento 000000000000000 ]--- Esto se debe a que llamar\\u00eda por error a kthread_stop() en un hilo de espacio de usuario, lo que har\\u00eda que \\\"salga\\\" antes de que realmente salga. Dado que kthread ---truncado---\"}]",
      "id": "CVE-2024-46788",
      "lastModified": "2024-11-22T16:59:50.313",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-09-18T08:15:05.893",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/177e1cc2f41235c145041eed03ef5bab18f32328\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/27282d2505b402f39371fd60d19d95c01a4b6776\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7a5f01828edf152c144d27cf63de446fdf2dc222\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46788\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-18T08:15:05.893\",\"lastModified\":\"2026-08-04T11:20:25.750\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing/osnoise: Use a cpumask to know what threads are kthreads\\n\\nThe start_kthread() and stop_thread() code was not always called with the\\ninterface_lock held. This means that the kthread variable could be\\nunexpectedly changed causing the kthread_stop() to be called on it when it\\nshould not have been, leading to:\\n\\n while true; do\\n   rtla timerlat top -u -q \u0026 PID=$!;\\n   sleep 5;\\n   kill -INT $PID;\\n   sleep 0.001;\\n   kill -TERM $PID;\\n   wait $PID;\\n  done\\n\\nCausing the following OOPS:\\n\\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI\\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\\n CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 Not tainted 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254\\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n RIP: 0010:hrtimer_active+0x58/0x300\\n Code: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 \u003c0f\u003e b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f\\n RSP: 0018:ffff88811d97f940 EFLAGS: 00010202\\n RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b\\n RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28\\n RBP: 0000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60\\n R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d\\n R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28\\n FS:  0000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000\\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0\\n Call Trace:\\n  \u003cTASK\u003e\\n  ? die_addr+0x40/0xa0\\n  ? exc_general_protection+0x154/0x230\\n  ? asm_exc_general_protection+0x26/0x30\\n  ? hrtimer_active+0x58/0x300\\n  ? __pfx_mutex_lock+0x10/0x10\\n  ? __pfx_locks_remove_file+0x10/0x10\\n  hrtimer_cancel+0x15/0x40\\n  timerlat_fd_release+0x8e/0x1f0\\n  ? security_file_release+0x43/0x80\\n  __fput+0x372/0xb10\\n  task_work_run+0x11e/0x1f0\\n  ? _raw_spin_lock+0x85/0xe0\\n  ? __pfx_task_work_run+0x10/0x10\\n  ? poison_slab_object+0x109/0x170\\n  ? do_exit+0x7a0/0x24b0\\n  do_exit+0x7bd/0x24b0\\n  ? __pfx_migrate_enable+0x10/0x10\\n  ? __pfx_do_exit+0x10/0x10\\n  ? __pfx_read_tsc+0x10/0x10\\n  ? ktime_get+0x64/0x140\\n  ? _raw_spin_lock_irq+0x86/0xe0\\n  do_group_exit+0xb0/0x220\\n  get_signal+0x17ba/0x1b50\\n  ? vfs_read+0x179/0xa40\\n  ? timerlat_fd_read+0x30b/0x9d0\\n  ? __pfx_get_signal+0x10/0x10\\n  ? __pfx_timerlat_fd_read+0x10/0x10\\n  arch_do_signal_or_restart+0x8c/0x570\\n  ? __pfx_arch_do_signal_or_restart+0x10/0x10\\n  ? vfs_read+0x179/0xa40\\n  ? ksys_read+0xfe/0x1d0\\n  ? __pfx_ksys_read+0x10/0x10\\n  syscall_exit_to_user_mode+0xbc/0x130\\n  do_syscall_64+0x74/0x110\\n  ? __pfx___rseq_handle_notify_resume+0x10/0x10\\n  ? __pfx_ksys_read+0x10/0x10\\n  ? fpregs_restore_userregs+0xdb/0x1e0\\n  ? fpregs_restore_userregs+0xdb/0x1e0\\n  ? syscall_exit_to_user_mode+0x116/0x130\\n  ? do_syscall_64+0x74/0x110\\n  ? do_syscall_64+0x74/0x110\\n  ? do_syscall_64+0x74/0x110\\n  entry_SYSCALL_64_after_hwframe+0x71/0x79\\n RIP: 0033:0x7ff0070eca9c\\n Code: Unable to access opcode bytes at 0x7ff0070eca72.\\n RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\\n RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c\\n RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003\\n RBP: 00007ff006dffde0 R08: 0000000000000000 R09: 00007ff000000ba0\\n R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003\\n R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008\\n  \u003c/TASK\u003e\\n Modules linked in: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core\\n ---[ end trace 0000000000000000 ]---\\n\\nThis is because it would mistakenly call kthread_stop() on a user space\\nthread making it \\\"exit\\\" before it actually exits.\\n\\nSince kthread\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracing/osnoise: Utilizar una cpumask para saber qu\u00e9 subprocesos son kthreads El c\u00f3digo start_kthread() y stop_thread() no siempre se llamaba con el interface_lock mantenido. Esto significa que la variable kthread podr\u00eda cambiar inesperadamente provocando que se llamara a kthread_stop() en ella cuando no deber\u00eda haberse hecho, lo que lleva a: while true; do rtla timerlat top -u -q \u0026amp; PID=$!; sleep 5; kill -INT $PID; sleep 0.001; kill -TERM $PID; wait $PID; hecho Provocando el siguiente OOPS: Oops: error de protecci\u00f3n general, probablemente para la direcci\u00f3n no can\u00f3nica 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref en el rango [0x000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 No contaminado 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254 Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 01/04/2014 RIP: 0010:hrtimer_active+0x58/0x300 C\u00f3digo: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 \u0026lt;0f\u0026gt; b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f RSP: 0018:ffff88811d97f940 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28 RBP: 000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60 R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28 FS: 000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0 Llamada Rastro:  ? die_addr+0x40/0xa0 ? exc_general_protection+0x154/0x230 ? asm_exc_general_protection+0x26/0x30 ? hrtimer_active+0x58/0x300 ? __pfx_mutex_lock+0x10/0x10 ? __pfx_locks_remove_file+0x10/0x10 hrtimer_cancel+0x15/0x40 timerlat_fd_release+0x8e/0x1f0 ? security_file_release+0x43/0x80 __fput+0x372/0xb10 task_work_run+0x11e/0x1f0 ? _raw_spin_lock+0x85/0xe0 ? __pfx_task_work_run+0x10/0x10 ? objeto poison_slab+0x109/0x170 ? do_exit+0x7a0/0x24b0 do_exit+0x7bd/0x24b0 ? __pfx_migrate_enable+0x10/0x10 ? __pfx_do_exit+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x64/0x140 ? _raw_spin_lock_irq+0x86/0xe0 do_group_exit+0xb0/0x220 obtener_se\u00f1al+0x17ba/0x1b50 ? vfs_read+0x179/0xa40 ? timerlat_fd_read+0x30b/0x9d0 ? __pfx_get_signal+0x10/0x10 ? __pfx_timerlat_fd_read+0x10/0x10 arch_do_signal_or_restart+0x8c/0x570 ? __pfx_arch_do_signal_or_restart+0x10/0x10 ? vfs_read+0x179/0xa40 ? ksys_read+0xfe/0x1d0 ? __pfx_ksys_read+0x10/0x10 syscall_salir_al_modo_usuario+0xbc/0x130 do_syscall_64+0x74/0x110 ? __pfx___rseq_handle_notify_resume+0x10/0x10 ? __pfx_ksys_read+0x10/0x10 ? fpregs_restore_userregs+0xdb/0x1e0 ? fpregs_restore_userregs+0xdb/0x1e0 ? syscall_salir_al_modo_usuario+0x116/0x130 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 entry_SYSCALL_64_after_hwframe+0x71/0x79 RIP: 0033:0x7ff0070eca9c C\u00f3digo: No se puede acceder a los bytes del c\u00f3digo de operaci\u00f3n en 0x7ff0070eca72. RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003 RBP: 00007ff006dffde0 R08: 000000000000000 R09: 00007ff000000ba0 R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003 R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008  M\u00f3dulos vinculados en: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core ---[ fin del seguimiento 000000000000000 ]--- Esto se debe a que llamar\u00eda por error a kthread_stop() en un hilo de espacio de usuario, lo que har\u00eda que \\\"salga\\\" antes de que realmente salga. Dado que kthread ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/trace_osnoise.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e88ed227f639ebcb31ed4e5b88756b47d904584b\",\"lessThan\":\"7a5f01828edf152c144d27cf63de446fdf2dc222\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e88ed227f639ebcb31ed4e5b88756b47d904584b\",\"lessThan\":\"27282d2505b402f39371fd60d19d95c01a4b6776\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e88ed227f639ebcb31ed4e5b88756b47d904584b\",\"lessThan\":\"177e1cc2f41235c145041eed03ef5bab18f32328\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/trace_osnoise.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.51\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.10\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T14:28:37.138959Z\",\"id\":\"CVE-2024-46788\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.51\",\"matchCriteriaId\":\"68960B54-63EE-43D7-A875-28E3ECFA945B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.10\",\"matchCriteriaId\":\"ACDEE48C-137A-4731-90D0-A675865E1BED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/177e1cc2f41235c145041eed03ef5bab18f32328\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/27282d2505b402f39371fd60d19d95c01a4b6776\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7a5f01828edf152c144d27cf63de446fdf2dc222\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:41:27+00:00",
      "cve": "CVE-2024-46788",
      "id": "CVE-2024-46788",
      "initial_release_date": "2024-09-18T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tracing/osnoise: Use a cpumask to know what threads are kthreads",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46788.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:38:13Z",
      "cve": "CVE-2024-46788",
      "id": "CVE-2024-46788",
      "initial_release_date": "2024-09-19T03:09:53Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "262",
      "product_status:recommended": "310",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-46788",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-46788.json",
      "version": "46"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46788\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T14:28:37.138959Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T14:28:41.254Z\"}}], \"cna\": {\"title\": \"tracing/osnoise: Use a cpumask to know what threads are kthreads\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e88ed227f639ebcb31ed4e5b88756b47d904584b\", \"lessThan\": \"7a5f01828edf152c144d27cf63de446fdf2dc222\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e88ed227f639ebcb31ed4e5b88756b47d904584b\", \"lessThan\": \"27282d2505b402f39371fd60d19d95c01a4b6776\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e88ed227f639ebcb31ed4e5b88756b47d904584b\", \"lessThan\": \"177e1cc2f41235c145041eed03ef5bab18f32328\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/trace/trace_osnoise.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.51\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/trace/trace_osnoise.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7a5f01828edf152c144d27cf63de446fdf2dc222\"}, {\"url\": \"https://git.kernel.org/stable/c/27282d2505b402f39371fd60d19d95c01a4b6776\"}, {\"url\": \"https://git.kernel.org/stable/c/177e1cc2f41235c145041eed03ef5bab18f32328\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing/osnoise: Use a cpumask to know what threads are kthreads\\n\\nThe start_kthread() and stop_thread() code was not always called with the\\ninterface_lock held. This means that the kthread variable could be\\nunexpectedly changed causing the kthread_stop() to be called on it when it\\nshould not have been, leading to:\\n\\n while true; do\\n   rtla timerlat top -u -q \u0026 PID=$!;\\n   sleep 5;\\n   kill -INT $PID;\\n   sleep 0.001;\\n   kill -TERM $PID;\\n   wait $PID;\\n  done\\n\\nCausing the following OOPS:\\n\\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI\\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\\n CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 Not tainted 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254\\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n RIP: 0010:hrtimer_active+0x58/0x300\\n Code: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 \u003c0f\u003e b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f\\n RSP: 0018:ffff88811d97f940 EFLAGS: 00010202\\n RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b\\n RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28\\n RBP: 0000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60\\n R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d\\n R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28\\n FS:  0000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000\\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0\\n Call Trace:\\n  \u003cTASK\u003e\\n  ? die_addr+0x40/0xa0\\n  ? exc_general_protection+0x154/0x230\\n  ? asm_exc_general_protection+0x26/0x30\\n  ? hrtimer_active+0x58/0x300\\n  ? __pfx_mutex_lock+0x10/0x10\\n  ? __pfx_locks_remove_file+0x10/0x10\\n  hrtimer_cancel+0x15/0x40\\n  timerlat_fd_release+0x8e/0x1f0\\n  ? security_file_release+0x43/0x80\\n  __fput+0x372/0xb10\\n  task_work_run+0x11e/0x1f0\\n  ? _raw_spin_lock+0x85/0xe0\\n  ? __pfx_task_work_run+0x10/0x10\\n  ? poison_slab_object+0x109/0x170\\n  ? do_exit+0x7a0/0x24b0\\n  do_exit+0x7bd/0x24b0\\n  ? __pfx_migrate_enable+0x10/0x10\\n  ? __pfx_do_exit+0x10/0x10\\n  ? __pfx_read_tsc+0x10/0x10\\n  ? ktime_get+0x64/0x140\\n  ? _raw_spin_lock_irq+0x86/0xe0\\n  do_group_exit+0xb0/0x220\\n  get_signal+0x17ba/0x1b50\\n  ? vfs_read+0x179/0xa40\\n  ? timerlat_fd_read+0x30b/0x9d0\\n  ? __pfx_get_signal+0x10/0x10\\n  ? __pfx_timerlat_fd_read+0x10/0x10\\n  arch_do_signal_or_restart+0x8c/0x570\\n  ? __pfx_arch_do_signal_or_restart+0x10/0x10\\n  ? vfs_read+0x179/0xa40\\n  ? ksys_read+0xfe/0x1d0\\n  ? __pfx_ksys_read+0x10/0x10\\n  syscall_exit_to_user_mode+0xbc/0x130\\n  do_syscall_64+0x74/0x110\\n  ? __pfx___rseq_handle_notify_resume+0x10/0x10\\n  ? __pfx_ksys_read+0x10/0x10\\n  ? fpregs_restore_userregs+0xdb/0x1e0\\n  ? fpregs_restore_userregs+0xdb/0x1e0\\n  ? syscall_exit_to_user_mode+0x116/0x130\\n  ? do_syscall_64+0x74/0x110\\n  ? do_syscall_64+0x74/0x110\\n  ? do_syscall_64+0x74/0x110\\n  entry_SYSCALL_64_after_hwframe+0x71/0x79\\n RIP: 0033:0x7ff0070eca9c\\n Code: Unable to access opcode bytes at 0x7ff0070eca72.\\n RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\\n RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c\\n RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003\\n RBP: 00007ff006dffde0 R08: 0000000000000000 R09: 00007ff000000ba0\\n R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003\\n R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008\\n  \u003c/TASK\u003e\\n Modules linked in: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core\\n ---[ end trace 0000000000000000 ]---\\n\\nThis is because it would mistakenly call kthread_stop() on a user space\\nthread making it \\\"exit\\\" before it actually exits.\\n\\nSince kthread\\n---truncated---\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:23:09.807Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46788\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:23:09.807Z\", \"dateReserved\": \"2024-09-11T15:12:18.278Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-18T07:12:44.352Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.