CVE-2024-56761

Summary

CVE-2024-56761 is a Linux kernel vulnerability that can lead to a dead loop if the Wake-up From Exception (WFE) state is not cleared properly in the x86 FRED (Flow Control and Exception Delivery) subsystem. When an indirect branch instruction sets the CPU's indirect branch tracker (IBT) into WFE state and encounters a missing-ENDBRANCH condition, the CPU raises a #CP fault. In the kernel's IBT self-test, the WFE state of the interrupted context must be cleared to let execution continue. FRED, which provides space on the entry stack to save and restore the WFE state, inadvertently preserves it, necessitating explicit clearing. Failure to do so may result in a dead loop. This issue is not related to the Interrupt Descriptor Table (IDT), but it poses a security concern if WFE is clobbered in unintended situations. Therefore, it is essential to clear WFE in the appropriate contexts, such as in ibt_clear_fred_wfe() and the !ibt_fatal code path.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.