CVE-2024-56675

Summary

CVE-2024-56675 is a Linux kernel vulnerability that has been addressed. The issue lies in the bpf (Berkeley Packet Filter) component, where a mismatch between bpf_prog and attachment RCU flavors can result in a Use-After-Free (UAF) condition. Specifically, uprobes, which always use bpf_prog_run_array_uprobe() under tasks-trace-RCU protection, can have non-sleepable BPF programs attached to them. Upon removal of this attachment, the bpf_prog is inadvertently freed via normal RCU. This leads to UAF of the bpf_prog, as the tasks-trace-RCU grace period is not guaranteed. The vulnerability has been mitigated by explicitly waiting for a tasks-trace-RCU grace period before removing bpf_prog attachments from perf_events.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.