CVE-2024-46788 (GCVE-0-2024-46788)

Vulnerability from cvelistv5 – Published: 2024-09-18 07:12 – Updated: 2026-05-11 20:36
VLAI
Title
tracing/osnoise: Use a cpumask to know what threads are kthreads
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Use a cpumask to know what threads are kthreads The start_kthread() and stop_thread() code was not always called with the interface_lock held. This means that the kthread variable could be unexpectedly changed causing the kthread_stop() to be called on it when it should not have been, leading to: while true; do rtla timerlat top -u -q & PID=$!; sleep 5; kill -INT $PID; sleep 0.001; kill -TERM $PID; wait $PID; done Causing the following OOPS: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 Not tainted 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:hrtimer_active+0x58/0x300 Code: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 <0f> b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f RSP: 0018:ffff88811d97f940 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28 RBP: 0000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60 R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28 FS: 0000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0 Call Trace: <TASK> ? die_addr+0x40/0xa0 ? exc_general_protection+0x154/0x230 ? asm_exc_general_protection+0x26/0x30 ? hrtimer_active+0x58/0x300 ? __pfx_mutex_lock+0x10/0x10 ? __pfx_locks_remove_file+0x10/0x10 hrtimer_cancel+0x15/0x40 timerlat_fd_release+0x8e/0x1f0 ? security_file_release+0x43/0x80 __fput+0x372/0xb10 task_work_run+0x11e/0x1f0 ? _raw_spin_lock+0x85/0xe0 ? __pfx_task_work_run+0x10/0x10 ? poison_slab_object+0x109/0x170 ? do_exit+0x7a0/0x24b0 do_exit+0x7bd/0x24b0 ? __pfx_migrate_enable+0x10/0x10 ? __pfx_do_exit+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x64/0x140 ? _raw_spin_lock_irq+0x86/0xe0 do_group_exit+0xb0/0x220 get_signal+0x17ba/0x1b50 ? vfs_read+0x179/0xa40 ? timerlat_fd_read+0x30b/0x9d0 ? __pfx_get_signal+0x10/0x10 ? __pfx_timerlat_fd_read+0x10/0x10 arch_do_signal_or_restart+0x8c/0x570 ? __pfx_arch_do_signal_or_restart+0x10/0x10 ? vfs_read+0x179/0xa40 ? ksys_read+0xfe/0x1d0 ? __pfx_ksys_read+0x10/0x10 syscall_exit_to_user_mode+0xbc/0x130 do_syscall_64+0x74/0x110 ? __pfx___rseq_handle_notify_resume+0x10/0x10 ? __pfx_ksys_read+0x10/0x10 ? fpregs_restore_userregs+0xdb/0x1e0 ? fpregs_restore_userregs+0xdb/0x1e0 ? syscall_exit_to_user_mode+0x116/0x130 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 entry_SYSCALL_64_after_hwframe+0x71/0x79 RIP: 0033:0x7ff0070eca9c Code: Unable to access opcode bytes at 0x7ff0070eca72. RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003 RBP: 00007ff006dffde0 R08: 0000000000000000 R09: 00007ff000000ba0 R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003 R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008 </TASK> Modules linked in: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core ---[ end trace 0000000000000000 ]--- This is because it would mistakenly call kthread_stop() on a user space thread making it "exit" before it actually exits. Since kthread ---truncated---
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e88ed227f639ebcb31ed4e5b88756b47d904584b , < 7a5f01828edf152c144d27cf63de446fdf2dc222 (git)
Affected: e88ed227f639ebcb31ed4e5b88756b47d904584b , < 27282d2505b402f39371fd60d19d95c01a4b6776 (git)
Affected: e88ed227f639ebcb31ed4e5b88756b47d904584b , < 177e1cc2f41235c145041eed03ef5bab18f32328 (git)
Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.51 , ≤ 6.6.* (semver)
Unaffected: 6.10.10 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46788",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T14:28:37.138959Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T14:28:52.086Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_osnoise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7a5f01828edf152c144d27cf63de446fdf2dc222",
              "status": "affected",
              "version": "e88ed227f639ebcb31ed4e5b88756b47d904584b",
              "versionType": "git"
            },
            {
              "lessThan": "27282d2505b402f39371fd60d19d95c01a4b6776",
              "status": "affected",
              "version": "e88ed227f639ebcb31ed4e5b88756b47d904584b",
              "versionType": "git"
            },
            {
              "lessThan": "177e1cc2f41235c145041eed03ef5bab18f32328",
              "status": "affected",
              "version": "e88ed227f639ebcb31ed4e5b88756b47d904584b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_osnoise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.51",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.10",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/osnoise: Use a cpumask to know what threads are kthreads\n\nThe start_kthread() and stop_thread() code was not always called with the\ninterface_lock held. This means that the kthread variable could be\nunexpectedly changed causing the kthread_stop() to be called on it when it\nshould not have been, leading to:\n\n while true; do\n   rtla timerlat top -u -q \u0026 PID=$!;\n   sleep 5;\n   kill -INT $PID;\n   sleep 0.001;\n   kill -TERM $PID;\n   wait $PID;\n  done\n\nCausing the following OOPS:\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 Not tainted 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n RIP: 0010:hrtimer_active+0x58/0x300\n Code: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 \u003c0f\u003e b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f\n RSP: 0018:ffff88811d97f940 EFLAGS: 00010202\n RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b\n RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28\n RBP: 0000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60\n R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d\n R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28\n FS:  0000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0\n Call Trace:\n  \u003cTASK\u003e\n  ? die_addr+0x40/0xa0\n  ? exc_general_protection+0x154/0x230\n  ? asm_exc_general_protection+0x26/0x30\n  ? hrtimer_active+0x58/0x300\n  ? __pfx_mutex_lock+0x10/0x10\n  ? __pfx_locks_remove_file+0x10/0x10\n  hrtimer_cancel+0x15/0x40\n  timerlat_fd_release+0x8e/0x1f0\n  ? security_file_release+0x43/0x80\n  __fput+0x372/0xb10\n  task_work_run+0x11e/0x1f0\n  ? _raw_spin_lock+0x85/0xe0\n  ? __pfx_task_work_run+0x10/0x10\n  ? poison_slab_object+0x109/0x170\n  ? do_exit+0x7a0/0x24b0\n  do_exit+0x7bd/0x24b0\n  ? __pfx_migrate_enable+0x10/0x10\n  ? __pfx_do_exit+0x10/0x10\n  ? __pfx_read_tsc+0x10/0x10\n  ? ktime_get+0x64/0x140\n  ? _raw_spin_lock_irq+0x86/0xe0\n  do_group_exit+0xb0/0x220\n  get_signal+0x17ba/0x1b50\n  ? vfs_read+0x179/0xa40\n  ? timerlat_fd_read+0x30b/0x9d0\n  ? __pfx_get_signal+0x10/0x10\n  ? __pfx_timerlat_fd_read+0x10/0x10\n  arch_do_signal_or_restart+0x8c/0x570\n  ? __pfx_arch_do_signal_or_restart+0x10/0x10\n  ? vfs_read+0x179/0xa40\n  ? ksys_read+0xfe/0x1d0\n  ? __pfx_ksys_read+0x10/0x10\n  syscall_exit_to_user_mode+0xbc/0x130\n  do_syscall_64+0x74/0x110\n  ? __pfx___rseq_handle_notify_resume+0x10/0x10\n  ? __pfx_ksys_read+0x10/0x10\n  ? fpregs_restore_userregs+0xdb/0x1e0\n  ? fpregs_restore_userregs+0xdb/0x1e0\n  ? syscall_exit_to_user_mode+0x116/0x130\n  ? do_syscall_64+0x74/0x110\n  ? do_syscall_64+0x74/0x110\n  ? do_syscall_64+0x74/0x110\n  entry_SYSCALL_64_after_hwframe+0x71/0x79\n RIP: 0033:0x7ff0070eca9c\n Code: Unable to access opcode bytes at 0x7ff0070eca72.\n RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\n RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c\n RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003\n RBP: 00007ff006dffde0 R08: 0000000000000000 R09: 00007ff000000ba0\n R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003\n R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008\n  \u003c/TASK\u003e\n Modules linked in: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core\n ---[ end trace 0000000000000000 ]---\n\nThis is because it would mistakenly call kthread_stop() on a user space\nthread making it \"exit\" before it actually exits.\n\nSince kthread\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:36:33.426Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7a5f01828edf152c144d27cf63de446fdf2dc222"
        },
        {
          "url": "https://git.kernel.org/stable/c/27282d2505b402f39371fd60d19d95c01a4b6776"
        },
        {
          "url": "https://git.kernel.org/stable/c/177e1cc2f41235c145041eed03ef5bab18f32328"
        }
      ],
      "title": "tracing/osnoise: Use a cpumask to know what threads are kthreads",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46788",
    "datePublished": "2024-09-18T07:12:44.352Z",
    "dateReserved": "2024-09-11T15:12:18.278Z",
    "dateUpdated": "2026-05-11T20:36:33.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46788",
      "date": "2026-07-25",
      "epss": "0.00206",
      "percentile": "0.10821"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.5\", \"versionEndExcluding\": \"6.6.51\", \"matchCriteriaId\": \"68960B54-63EE-43D7-A875-28E3ECFA945B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.10\", \"matchCriteriaId\": \"ACDEE48C-137A-4731-90D0-A675865E1BED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0005AEF-856E-47EB-BFE4-90C46899394D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"39889A68-6D34-47A6-82FC-CD0BF23D6754\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing/osnoise: Use a cpumask to know what threads are kthreads\\n\\nThe start_kthread() and stop_thread() code was not always called with the\\ninterface_lock held. This means that the kthread variable could be\\nunexpectedly changed causing the kthread_stop() to be called on it when it\\nshould not have been, leading to:\\n\\n while true; do\\n   rtla timerlat top -u -q \u0026 PID=$!;\\n   sleep 5;\\n   kill -INT $PID;\\n   sleep 0.001;\\n   kill -TERM $PID;\\n   wait $PID;\\n  done\\n\\nCausing the following OOPS:\\n\\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI\\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\\n CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 Not tainted 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254\\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n RIP: 0010:hrtimer_active+0x58/0x300\\n Code: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 \u003c0f\u003e b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f\\n RSP: 0018:ffff88811d97f940 EFLAGS: 00010202\\n RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b\\n RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28\\n RBP: 0000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60\\n R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d\\n R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28\\n FS:  0000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000\\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0\\n Call Trace:\\n  \u003cTASK\u003e\\n  ? die_addr+0x40/0xa0\\n  ? exc_general_protection+0x154/0x230\\n  ? asm_exc_general_protection+0x26/0x30\\n  ? hrtimer_active+0x58/0x300\\n  ? __pfx_mutex_lock+0x10/0x10\\n  ? __pfx_locks_remove_file+0x10/0x10\\n  hrtimer_cancel+0x15/0x40\\n  timerlat_fd_release+0x8e/0x1f0\\n  ? security_file_release+0x43/0x80\\n  __fput+0x372/0xb10\\n  task_work_run+0x11e/0x1f0\\n  ? _raw_spin_lock+0x85/0xe0\\n  ? __pfx_task_work_run+0x10/0x10\\n  ? poison_slab_object+0x109/0x170\\n  ? do_exit+0x7a0/0x24b0\\n  do_exit+0x7bd/0x24b0\\n  ? __pfx_migrate_enable+0x10/0x10\\n  ? __pfx_do_exit+0x10/0x10\\n  ? __pfx_read_tsc+0x10/0x10\\n  ? ktime_get+0x64/0x140\\n  ? _raw_spin_lock_irq+0x86/0xe0\\n  do_group_exit+0xb0/0x220\\n  get_signal+0x17ba/0x1b50\\n  ? vfs_read+0x179/0xa40\\n  ? timerlat_fd_read+0x30b/0x9d0\\n  ? __pfx_get_signal+0x10/0x10\\n  ? __pfx_timerlat_fd_read+0x10/0x10\\n  arch_do_signal_or_restart+0x8c/0x570\\n  ? __pfx_arch_do_signal_or_restart+0x10/0x10\\n  ? vfs_read+0x179/0xa40\\n  ? ksys_read+0xfe/0x1d0\\n  ? __pfx_ksys_read+0x10/0x10\\n  syscall_exit_to_user_mode+0xbc/0x130\\n  do_syscall_64+0x74/0x110\\n  ? __pfx___rseq_handle_notify_resume+0x10/0x10\\n  ? __pfx_ksys_read+0x10/0x10\\n  ? fpregs_restore_userregs+0xdb/0x1e0\\n  ? fpregs_restore_userregs+0xdb/0x1e0\\n  ? syscall_exit_to_user_mode+0x116/0x130\\n  ? do_syscall_64+0x74/0x110\\n  ? do_syscall_64+0x74/0x110\\n  ? do_syscall_64+0x74/0x110\\n  entry_SYSCALL_64_after_hwframe+0x71/0x79\\n RIP: 0033:0x7ff0070eca9c\\n Code: Unable to access opcode bytes at 0x7ff0070eca72.\\n RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\\n RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c\\n RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003\\n RBP: 00007ff006dffde0 R08: 0000000000000000 R09: 00007ff000000ba0\\n R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003\\n R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008\\n  \u003c/TASK\u003e\\n Modules linked in: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core\\n ---[ end trace 0000000000000000 ]---\\n\\nThis is because it would mistakenly call kthread_stop() on a user space\\nthread making it \\\"exit\\\" before it actually exits.\\n\\nSince kthread\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracing/osnoise: Utilizar una cpumask para saber qu\\u00e9 subprocesos son kthreads El c\\u00f3digo start_kthread() y stop_thread() no siempre se llamaba con el interface_lock mantenido. Esto significa que la variable kthread podr\\u00eda cambiar inesperadamente provocando que se llamara a kthread_stop() en ella cuando no deber\\u00eda haberse hecho, lo que lleva a: while true; do rtla timerlat top -u -q \u0026amp; PID=$!; sleep 5; kill -INT $PID; sleep 0.001; kill -TERM $PID; wait $PID; hecho Provocando el siguiente OOPS: Oops: error de protecci\\u00f3n general, probablemente para la direcci\\u00f3n no can\\u00f3nica 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref en el rango [0x000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 No contaminado 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254 Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 01/04/2014 RIP: 0010:hrtimer_active+0x58/0x300 C\\u00f3digo: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 \u0026lt;0f\u0026gt; b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f RSP: 0018:ffff88811d97f940 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28 RBP: 000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60 R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28 FS: 000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0 Llamada Rastro:  ? die_addr+0x40/0xa0 ? exc_general_protection+0x154/0x230 ? asm_exc_general_protection+0x26/0x30 ? hrtimer_active+0x58/0x300 ? __pfx_mutex_lock+0x10/0x10 ? __pfx_locks_remove_file+0x10/0x10 hrtimer_cancel+0x15/0x40 timerlat_fd_release+0x8e/0x1f0 ? security_file_release+0x43/0x80 __fput+0x372/0xb10 task_work_run+0x11e/0x1f0 ? _raw_spin_lock+0x85/0xe0 ? __pfx_task_work_run+0x10/0x10 ? objeto poison_slab+0x109/0x170 ? do_exit+0x7a0/0x24b0 do_exit+0x7bd/0x24b0 ? __pfx_migrate_enable+0x10/0x10 ? __pfx_do_exit+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x64/0x140 ? _raw_spin_lock_irq+0x86/0xe0 do_group_exit+0xb0/0x220 obtener_se\\u00f1al+0x17ba/0x1b50 ? vfs_read+0x179/0xa40 ? timerlat_fd_read+0x30b/0x9d0 ? __pfx_get_signal+0x10/0x10 ? __pfx_timerlat_fd_read+0x10/0x10 arch_do_signal_or_restart+0x8c/0x570 ? __pfx_arch_do_signal_or_restart+0x10/0x10 ? vfs_read+0x179/0xa40 ? ksys_read+0xfe/0x1d0 ? __pfx_ksys_read+0x10/0x10 syscall_salir_al_modo_usuario+0xbc/0x130 do_syscall_64+0x74/0x110 ? __pfx___rseq_handle_notify_resume+0x10/0x10 ? __pfx_ksys_read+0x10/0x10 ? fpregs_restore_userregs+0xdb/0x1e0 ? fpregs_restore_userregs+0xdb/0x1e0 ? syscall_salir_al_modo_usuario+0x116/0x130 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 entry_SYSCALL_64_after_hwframe+0x71/0x79 RIP: 0033:0x7ff0070eca9c C\\u00f3digo: No se puede acceder a los bytes del c\\u00f3digo de operaci\\u00f3n en 0x7ff0070eca72. RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003 RBP: 00007ff006dffde0 R08: 000000000000000 R09: 00007ff000000ba0 R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003 R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008  M\\u00f3dulos vinculados en: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core ---[ fin del seguimiento 000000000000000 ]--- Esto se debe a que llamar\\u00eda por error a kthread_stop() en un hilo de espacio de usuario, lo que har\\u00eda que \\\"salga\\\" antes de que realmente salga. Dado que kthread ---truncado---\"}]",
      "id": "CVE-2024-46788",
      "lastModified": "2024-11-22T16:59:50.313",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-09-18T08:15:05.893",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/177e1cc2f41235c145041eed03ef5bab18f32328\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/27282d2505b402f39371fd60d19d95c01a4b6776\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7a5f01828edf152c144d27cf63de446fdf2dc222\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46788\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-18T08:15:05.893\",\"lastModified\":\"2026-06-17T07:55:56.130\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing/osnoise: Use a cpumask to know what threads are kthreads\\n\\nThe start_kthread() and stop_thread() code was not always called with the\\ninterface_lock held. This means that the kthread variable could be\\nunexpectedly changed causing the kthread_stop() to be called on it when it\\nshould not have been, leading to:\\n\\n while true; do\\n   rtla timerlat top -u -q \u0026 PID=$!;\\n   sleep 5;\\n   kill -INT $PID;\\n   sleep 0.001;\\n   kill -TERM $PID;\\n   wait $PID;\\n  done\\n\\nCausing the following OOPS:\\n\\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI\\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\\n CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 Not tainted 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254\\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n RIP: 0010:hrtimer_active+0x58/0x300\\n Code: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 \u003c0f\u003e b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f\\n RSP: 0018:ffff88811d97f940 EFLAGS: 00010202\\n RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b\\n RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28\\n RBP: 0000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60\\n R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d\\n R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28\\n FS:  0000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000\\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0\\n Call Trace:\\n  \u003cTASK\u003e\\n  ? die_addr+0x40/0xa0\\n  ? exc_general_protection+0x154/0x230\\n  ? asm_exc_general_protection+0x26/0x30\\n  ? hrtimer_active+0x58/0x300\\n  ? __pfx_mutex_lock+0x10/0x10\\n  ? __pfx_locks_remove_file+0x10/0x10\\n  hrtimer_cancel+0x15/0x40\\n  timerlat_fd_release+0x8e/0x1f0\\n  ? security_file_release+0x43/0x80\\n  __fput+0x372/0xb10\\n  task_work_run+0x11e/0x1f0\\n  ? _raw_spin_lock+0x85/0xe0\\n  ? __pfx_task_work_run+0x10/0x10\\n  ? poison_slab_object+0x109/0x170\\n  ? do_exit+0x7a0/0x24b0\\n  do_exit+0x7bd/0x24b0\\n  ? __pfx_migrate_enable+0x10/0x10\\n  ? __pfx_do_exit+0x10/0x10\\n  ? __pfx_read_tsc+0x10/0x10\\n  ? ktime_get+0x64/0x140\\n  ? _raw_spin_lock_irq+0x86/0xe0\\n  do_group_exit+0xb0/0x220\\n  get_signal+0x17ba/0x1b50\\n  ? vfs_read+0x179/0xa40\\n  ? timerlat_fd_read+0x30b/0x9d0\\n  ? __pfx_get_signal+0x10/0x10\\n  ? __pfx_timerlat_fd_read+0x10/0x10\\n  arch_do_signal_or_restart+0x8c/0x570\\n  ? __pfx_arch_do_signal_or_restart+0x10/0x10\\n  ? vfs_read+0x179/0xa40\\n  ? ksys_read+0xfe/0x1d0\\n  ? __pfx_ksys_read+0x10/0x10\\n  syscall_exit_to_user_mode+0xbc/0x130\\n  do_syscall_64+0x74/0x110\\n  ? __pfx___rseq_handle_notify_resume+0x10/0x10\\n  ? __pfx_ksys_read+0x10/0x10\\n  ? fpregs_restore_userregs+0xdb/0x1e0\\n  ? fpregs_restore_userregs+0xdb/0x1e0\\n  ? syscall_exit_to_user_mode+0x116/0x130\\n  ? do_syscall_64+0x74/0x110\\n  ? do_syscall_64+0x74/0x110\\n  ? do_syscall_64+0x74/0x110\\n  entry_SYSCALL_64_after_hwframe+0x71/0x79\\n RIP: 0033:0x7ff0070eca9c\\n Code: Unable to access opcode bytes at 0x7ff0070eca72.\\n RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\\n RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c\\n RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003\\n RBP: 00007ff006dffde0 R08: 0000000000000000 R09: 00007ff000000ba0\\n R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003\\n R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008\\n  \u003c/TASK\u003e\\n Modules linked in: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core\\n ---[ end trace 0000000000000000 ]---\\n\\nThis is because it would mistakenly call kthread_stop() on a user space\\nthread making it \\\"exit\\\" before it actually exits.\\n\\nSince kthread\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracing/osnoise: Utilizar una cpumask para saber qu\u00e9 subprocesos son kthreads El c\u00f3digo start_kthread() y stop_thread() no siempre se llamaba con el interface_lock mantenido. Esto significa que la variable kthread podr\u00eda cambiar inesperadamente provocando que se llamara a kthread_stop() en ella cuando no deber\u00eda haberse hecho, lo que lleva a: while true; do rtla timerlat top -u -q \u0026amp; PID=$!; sleep 5; kill -INT $PID; sleep 0.001; kill -TERM $PID; wait $PID; hecho Provocando el siguiente OOPS: Oops: error de protecci\u00f3n general, probablemente para la direcci\u00f3n no can\u00f3nica 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref en el rango [0x000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 No contaminado 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254 Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 01/04/2014 RIP: 0010:hrtimer_active+0x58/0x300 C\u00f3digo: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 \u0026lt;0f\u0026gt; b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f RSP: 0018:ffff88811d97f940 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28 RBP: 000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60 R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28 FS: 000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0 Llamada Rastro:  ? die_addr+0x40/0xa0 ? exc_general_protection+0x154/0x230 ? asm_exc_general_protection+0x26/0x30 ? hrtimer_active+0x58/0x300 ? __pfx_mutex_lock+0x10/0x10 ? __pfx_locks_remove_file+0x10/0x10 hrtimer_cancel+0x15/0x40 timerlat_fd_release+0x8e/0x1f0 ? security_file_release+0x43/0x80 __fput+0x372/0xb10 task_work_run+0x11e/0x1f0 ? _raw_spin_lock+0x85/0xe0 ? __pfx_task_work_run+0x10/0x10 ? objeto poison_slab+0x109/0x170 ? do_exit+0x7a0/0x24b0 do_exit+0x7bd/0x24b0 ? __pfx_migrate_enable+0x10/0x10 ? __pfx_do_exit+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x64/0x140 ? _raw_spin_lock_irq+0x86/0xe0 do_group_exit+0xb0/0x220 obtener_se\u00f1al+0x17ba/0x1b50 ? vfs_read+0x179/0xa40 ? timerlat_fd_read+0x30b/0x9d0 ? __pfx_get_signal+0x10/0x10 ? __pfx_timerlat_fd_read+0x10/0x10 arch_do_signal_or_restart+0x8c/0x570 ? __pfx_arch_do_signal_or_restart+0x10/0x10 ? vfs_read+0x179/0xa40 ? ksys_read+0xfe/0x1d0 ? __pfx_ksys_read+0x10/0x10 syscall_salir_al_modo_usuario+0xbc/0x130 do_syscall_64+0x74/0x110 ? __pfx___rseq_handle_notify_resume+0x10/0x10 ? __pfx_ksys_read+0x10/0x10 ? fpregs_restore_userregs+0xdb/0x1e0 ? fpregs_restore_userregs+0xdb/0x1e0 ? syscall_salir_al_modo_usuario+0x116/0x130 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 ? do_syscall_64+0x74/0x110 entry_SYSCALL_64_after_hwframe+0x71/0x79 RIP: 0033:0x7ff0070eca9c C\u00f3digo: No se puede acceder a los bytes del c\u00f3digo de operaci\u00f3n en 0x7ff0070eca72. RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003 RBP: 00007ff006dffde0 R08: 000000000000000 R09: 00007ff000000ba0 R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003 R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008  M\u00f3dulos vinculados en: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core ---[ fin del seguimiento 000000000000000 ]--- Esto se debe a que llamar\u00eda por error a kthread_stop() en un hilo de espacio de usuario, lo que har\u00eda que \\\"salga\\\" antes de que realmente salga. Dado que kthread ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/trace_osnoise.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e88ed227f639ebcb31ed4e5b88756b47d904584b\",\"lessThan\":\"7a5f01828edf152c144d27cf63de446fdf2dc222\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e88ed227f639ebcb31ed4e5b88756b47d904584b\",\"lessThan\":\"27282d2505b402f39371fd60d19d95c01a4b6776\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e88ed227f639ebcb31ed4e5b88756b47d904584b\",\"lessThan\":\"177e1cc2f41235c145041eed03ef5bab18f32328\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/trace_osnoise.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.51\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.10\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T14:28:37.138959Z\",\"id\":\"CVE-2024-46788\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.51\",\"matchCriteriaId\":\"68960B54-63EE-43D7-A875-28E3ECFA945B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.10\",\"matchCriteriaId\":\"ACDEE48C-137A-4731-90D0-A675865E1BED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/177e1cc2f41235c145041eed03ef5bab18f32328\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/27282d2505b402f39371fd60d19d95c01a4b6776\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7a5f01828edf152c144d27cf63de446fdf2dc222\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T14:20:24+00:00",
      "cve": "CVE-2024-46788",
      "id": "CVE-2024-46788",
      "initial_release_date": "2024-09-18T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tracing/osnoise: Use a cpumask to know what threads are kthreads",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46788.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:38:13Z",
      "cve": "CVE-2024-46788",
      "id": "CVE-2024-46788",
      "initial_release_date": "2024-09-19T03:09:53Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "262",
      "product_status:recommended": "310",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-46788",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-46788.json",
      "version": "46"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46788\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T14:28:37.138959Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T14:28:41.254Z\"}}], \"cna\": {\"title\": \"tracing/osnoise: Use a cpumask to know what threads are kthreads\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e88ed227f639ebcb31ed4e5b88756b47d904584b\", \"lessThan\": \"7a5f01828edf152c144d27cf63de446fdf2dc222\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e88ed227f639ebcb31ed4e5b88756b47d904584b\", \"lessThan\": \"27282d2505b402f39371fd60d19d95c01a4b6776\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e88ed227f639ebcb31ed4e5b88756b47d904584b\", \"lessThan\": \"177e1cc2f41235c145041eed03ef5bab18f32328\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/trace/trace_osnoise.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.51\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/trace/trace_osnoise.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7a5f01828edf152c144d27cf63de446fdf2dc222\"}, {\"url\": \"https://git.kernel.org/stable/c/27282d2505b402f39371fd60d19d95c01a4b6776\"}, {\"url\": \"https://git.kernel.org/stable/c/177e1cc2f41235c145041eed03ef5bab18f32328\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing/osnoise: Use a cpumask to know what threads are kthreads\\n\\nThe start_kthread() and stop_thread() code was not always called with the\\ninterface_lock held. This means that the kthread variable could be\\nunexpectedly changed causing the kthread_stop() to be called on it when it\\nshould not have been, leading to:\\n\\n while true; do\\n   rtla timerlat top -u -q \u0026 PID=$!;\\n   sleep 5;\\n   kill -INT $PID;\\n   sleep 0.001;\\n   kill -TERM $PID;\\n   wait $PID;\\n  done\\n\\nCausing the following OOPS:\\n\\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN PTI\\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\\n CPU: 5 UID: 0 PID: 885 Comm: timerlatu/5 Not tainted 6.11.0-rc4-test-00002-gbc754cc76d1b-dirty #125 a533010b71dab205ad2f507188ce8c82203b0254\\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n RIP: 0010:hrtimer_active+0x58/0x300\\n Code: 48 c1 ee 03 41 54 48 01 d1 48 01 d6 55 53 48 83 ec 20 80 39 00 0f 85 30 02 00 00 49 8b 6f 30 4c 8d 75 10 4c 89 f0 48 c1 e8 03 \u003c0f\u003e b6 3c 10 4c 89 f0 83 e0 07 83 c0 03 40 38 f8 7c 09 40 84 ff 0f\\n RSP: 0018:ffff88811d97f940 EFLAGS: 00010202\\n RAX: 0000000000000002 RBX: ffff88823c6b5b28 RCX: ffffed10478d6b6b\\n RDX: dffffc0000000000 RSI: ffffed10478d6b6c RDI: ffff88823c6b5b28\\n RBP: 0000000000000000 R08: ffff88823c6b5b58 R09: ffff88823c6b5b60\\n R10: ffff88811d97f957 R11: 0000000000000010 R12: 00000000000a801d\\n R13: ffff88810d8b35d8 R14: 0000000000000010 R15: ffff88823c6b5b28\\n FS:  0000000000000000(0000) GS:ffff88823c680000(0000) knlGS:0000000000000000\\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n CR2: 0000561858ad7258 CR3: 000000007729e001 CR4: 0000000000170ef0\\n Call Trace:\\n  \u003cTASK\u003e\\n  ? die_addr+0x40/0xa0\\n  ? exc_general_protection+0x154/0x230\\n  ? asm_exc_general_protection+0x26/0x30\\n  ? hrtimer_active+0x58/0x300\\n  ? __pfx_mutex_lock+0x10/0x10\\n  ? __pfx_locks_remove_file+0x10/0x10\\n  hrtimer_cancel+0x15/0x40\\n  timerlat_fd_release+0x8e/0x1f0\\n  ? security_file_release+0x43/0x80\\n  __fput+0x372/0xb10\\n  task_work_run+0x11e/0x1f0\\n  ? _raw_spin_lock+0x85/0xe0\\n  ? __pfx_task_work_run+0x10/0x10\\n  ? poison_slab_object+0x109/0x170\\n  ? do_exit+0x7a0/0x24b0\\n  do_exit+0x7bd/0x24b0\\n  ? __pfx_migrate_enable+0x10/0x10\\n  ? __pfx_do_exit+0x10/0x10\\n  ? __pfx_read_tsc+0x10/0x10\\n  ? ktime_get+0x64/0x140\\n  ? _raw_spin_lock_irq+0x86/0xe0\\n  do_group_exit+0xb0/0x220\\n  get_signal+0x17ba/0x1b50\\n  ? vfs_read+0x179/0xa40\\n  ? timerlat_fd_read+0x30b/0x9d0\\n  ? __pfx_get_signal+0x10/0x10\\n  ? __pfx_timerlat_fd_read+0x10/0x10\\n  arch_do_signal_or_restart+0x8c/0x570\\n  ? __pfx_arch_do_signal_or_restart+0x10/0x10\\n  ? vfs_read+0x179/0xa40\\n  ? ksys_read+0xfe/0x1d0\\n  ? __pfx_ksys_read+0x10/0x10\\n  syscall_exit_to_user_mode+0xbc/0x130\\n  do_syscall_64+0x74/0x110\\n  ? __pfx___rseq_handle_notify_resume+0x10/0x10\\n  ? __pfx_ksys_read+0x10/0x10\\n  ? fpregs_restore_userregs+0xdb/0x1e0\\n  ? fpregs_restore_userregs+0xdb/0x1e0\\n  ? syscall_exit_to_user_mode+0x116/0x130\\n  ? do_syscall_64+0x74/0x110\\n  ? do_syscall_64+0x74/0x110\\n  ? do_syscall_64+0x74/0x110\\n  entry_SYSCALL_64_after_hwframe+0x71/0x79\\n RIP: 0033:0x7ff0070eca9c\\n Code: Unable to access opcode bytes at 0x7ff0070eca72.\\n RSP: 002b:00007ff006dff8c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\\n RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007ff0070eca9c\\n RDX: 0000000000000400 RSI: 00007ff006dff9a0 RDI: 0000000000000003\\n RBP: 00007ff006dffde0 R08: 0000000000000000 R09: 00007ff000000ba0\\n R10: 00007ff007004b08 R11: 0000000000000246 R12: 0000000000000003\\n R13: 00007ff006dff9a0 R14: 0000000000000007 R15: 0000000000000008\\n  \u003c/TASK\u003e\\n Modules linked in: snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core\\n ---[ end trace 0000000000000000 ]---\\n\\nThis is because it would mistakenly call kthread_stop() on a user space\\nthread making it \\\"exit\\\" before it actually exits.\\n\\nSince kthread\\n---truncated---\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:23:09.807Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46788\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:23:09.807Z\", \"dateReserved\": \"2024-09-11T15:12:18.278Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-18T07:12:44.352Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.