Junglewise Threat Intelligence

CVE-2024-57951: Linux Kernel use-after-free in hrtimer CPU hotplug

CVE-2024-57951 · Severity: high · CVSS 7.8 · Published 2025-02-12

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's high-resolution timer (hrtimer) system could allow a local attacker to cause system instability or potentially execute unauthorized code. The issue occurs when a processor core is partially shut down and then restarted, leaving the system in an inconsistent state with 'dangling pointers' to memory. This could lead to data corruption, system crashes, or a breach of confidentiality and integrity on affected servers and workstations.

Technical details

A use-after-free (CWE-416) vulnerability exists in the Linux kernel's hrtimer subsystem due to improper handling of CPU state during hotplug operations. When a CPU transitions from ONLINE to a partial unplug state (CPUHP_HRTIMERS_PREPARE) and back to ONLINE, the 'hrtimers_prepare_cpu' function does not run, leaving 'cpu_base.hres_active' set and failing to reset per-CPU state. This results in dangling pointers and an incorrect 'online' flag, which can trigger WARN_ON_ONCE in 'enqueue_hrtimer()'. An attacker with local access could exploit this inconsistent state to achieve arbitrary code execution or cause a denial of service. The fix introduces a startup() callback to properly reset stale per-CPU state and set the online flag during CPU hotplug.

Affected products

  • Linux Linux Kernel 4.19.302 to 4.20, 5.4.264 to 5.4.290, 5.10.204 to 5.10.234, 5.15.143 to 5.15.177, 6.1.68 to 6.1.127, 6.6.7 to 6.6.74, 6.7 to 6.12.11, 6.13-rc1 to 6.13-rc7

Timeline

  • 2024-12-20: disclosed: Initial patch submission
  • 2025-02-12: advisory: CVE published

References

Related threats