Junglewise Threat Intelligence

CVE-2024-43890: Linux Kernel integer overflow in tracing_map

CVE-2024-43890 · Severity: medium · CVSS 5.5 · Published 2024-08-26

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's tracing mechanism could allow a local user to cause a system-wide crash. By triggering an overflow in how the system tracks internal tracing data, an attacker can force the processor into an infinite loop. This results in a 'CPU hang,' effectively freezing the operating system and disrupting all running services.

Technical details

An integer overflow vulnerability exists in the 'get_free_elt()' function within 'kernel/trace/tracing_map.c'. The 'tracing_map->next_elt' counter can overflow, allowing new elements to be inserted even after the 'max_elts' limit is reached. If the map becomes completely full, subsequent calls to '__tracing_map_insert()' enter an infinite loop with preemption disabled. This root cause leads to a CPU hang (Denial of Service). The issue is resolved by using 'atomic_fetch_add_unless' to prevent the counter from exceeding 'max_elts'. The vulnerability is reachable by local users with sufficient privileges to interact with the kernel tracing subsystem.

Affected products

  • Linux Linux Kernel 4.7 to 4.19.319, 4.20 to 5.4.281, 5.5 to 5.10.223, 5.11 to 5.15.164, 5.16 to 6.1.104, 6.2 to 6.6.45, 6.7 to 6.10.4

Timeline

  • 2024-08-05: patched: Initial patch submitted by Mediatek developers.
  • 2024-08-26: disclosed: CVE-2024-43890 published.

References

Related threats