CVE-2024-38667 riscv: prevent pt_regs corruption for secondary idle threads
A memory corruption flaw in the Linux kernel RISC-V architecture allows stack overlap, potentially leading to system crashes or arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38667?
CVE-2024-38667 is a high-severity memory corruption vulnerability in Linux kernel, published on 24 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
riscv: prevent pt_regs corruption for secondary idle threads
Top of the kernel thread stack should be reserved for pt_regs. However this is not the case for the idle threads of the secondary boot harts. Their stacks overlap with their pt_regs, so both may get corrupted.
Similar issue has been fixed for the primary hart, see c7cdd96eca28 ("riscv: prevent stack corruption by reserving task_pt_regs(p) early"). However that fix was not propagated to the secondary harts. The problem has been noticed in some CPU hotplug tests with V enabled. The function smp_callin stored several registers on stack, corrupting top of pt_regs structure including status field. As a result, kernel attempted to save or restore inexistent V context.
Weakness: CWE-787
Which versions are affected by CVE-2024-38667?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-38667?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-38667 being exploited?
There is no known exploitation of CVE-2024-38667 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-42901, BELL-CVE-2024-38667, DEBIAN-CVE-2024-38667, GHSA-cqg5-mcpx-q78p, ROOT-OS-DEBIAN-11-CVE-2024-38667, UBUNTU-CVE-2024-38667.