Junglewise Threat Intelligence

CVE-2024-26920: Linux Kernel error handling failure in tracing snapshot trigger

CVE-2024-26920 · Severity: medium · CVSS 5.5 · Published 2024-04-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's tracing subsystem, which is used by developers and system administrators to monitor system performance and behavior. Due to a programming error, the system may fail to report an error when it cannot allocate memory for a 'snapshot' trigger. This can lead to unexpected system behavior or instability if the tracing tool continues to operate under the false assumption that the memory was successfully reserved.

Technical details

A vulnerability was identified in the register_snapshot_trigger() function within kernel/trace/trace_events_trigger.c of the Linux kernel. The function incorrectly returned 0 (success) even when tracing_alloc_snapshot_instance() failed to allocate a snapshot. This logic error allows a snapshot trigger to be registered without the necessary backing memory, leading to potential null pointer dereferences or other undefined behavior when the trigger is subsequently invoked. The issue is reachable by a local user with sufficient privileges to configure kernel tracing triggers. Patches have been released across multiple stable kernel branches to ensure the function correctly propagates error codes.

Affected products

  • Linux Linux Kernel 4.4.220 to 4.5, 4.9.220 to 4.10, 4.14.177 to 4.15, 4.19.117 to 4.20, 5.4.34 to 5.5, 5.5.19 to 5.6, 5.6.6 to 5.7, 5.7.1 to 6.1.79, 6.2 to 6.6.18, 6.7 to 6.7.6

Timeline

  • 2024-01-26: patched: Initial fix committed to mainline kernel
  • 2024-04-17: disclosed: CVE-2024-26920 published

References

Related threats