CVE-2024-46713 perf/aux: Fix AUX buffer serialization
A race condition in the Linux kernel's perf AUX buffer handling allows attackers to potentially execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-46713?
CVE-2024-46713 is a high-severity vulnerability in Linux kernel, published on 13 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
perf/aux: Fix AUX buffer serialization
Ole reported that event->mmap_mutex is strictly insufficient to serialize the AUX buffer, add a per RB mutex to fully serialize it.
Note that in the lock order comment the perf_event::mmap_mutex order was already wrong, that is, it nesting under mmap_lock is not new with this patch.
Weakness: CWE-787
Which versions are affected by CVE-2024-46713?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-46713?
Apply the vendor's patch.
Is CVE-2024-46713 being exploited?
There is no known exploitation of CVE-2024-46713 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-46713, DEBIAN-CVE-2024-46713, GHSA-jgpx-8fg9-hh7j, UBUNTU-CVE-2024-46713.