CVE-2024-56665

Summary

CVE-2024-56665 is a vulnerability in the Linux kernel that affected the bpf and perf subsystems. The issue stemmed from an invalid prog_array access in perf_event_detach_bopf_prog. Syzbot identified a scenario where a tracing event with inherited attributes was created and attached to a process, which forked and released the event in both parent and child processes. When trying to detach the bpf program from the events in reverse order, the second call to perf_event_detach_bpf_prog would crash due to a NULL prog_array. This vulnerability has been resolved by ensuring that perf_event_detach_bpf_prog checks the validity of prog_array before attempting to remove bpf programs. [ [References](https://lore.kernel.org/bpf/Z1MR6dCIKajNS6nU@krava/T/#m91dbf0688221ec7a7fc95e896a7ef9ff93b0b8ad)]

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.