CVE-2024-46845

Summary

CVE-2024-46845 is a vulnerability affecting the Linux kernel's tracing/timerlat component. The issue arises when user space threads are used to check for osnoise and timer latency. If these threads are terminated via SIGTERM before they can be properly closed, they can cause a use-after-free bug by triggering the shutdown and subsequent freeing of a hrtimer assigned to the respective kthread more than once. To mitigate this issue, the kernel now only cancels the hrtimer if the associated thread is still present. Additionally, an interface_lock has been added to ensure proper synchronization between the shutdown of old threads and the starting of new ones. This is a temporary fix, and a more comprehensive solution to address the synchronization issue between thread termination and hrtimer management is required.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.