CVE-2024-46762 xen: privcmd: Fix possible access to a freed kirqfd instance
A race condition in the Linux kernel Xen driver allows accessing a freed kirqfd instance, potentially causing a kernel oops and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-46762?
CVE-2024-46762 is a high-severity use after free vulnerability in Linux kernel, published on 18 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xen: privcmd: Fix possible access to a freed kirqfd instance
Nothing prevents simultaneous ioctl calls to privcmd_irqfd_assign() and privcmd_irqfd_deassign(). If that happens, it is possible that a kirqfd created and added to the irqfds_list by privcmd_irqfd_assign() may get removed by another thread executing privcmd_irqfd_deassign(), while the former is still using it after dropping the locks.
This can lead to a situation where an already freed kirqfd instance may be accessed and cause kernel oops.
Use SRCU locking to prevent the same, as is done for the KVM implementation for irqfds.
Weakness: CWE-416
Which versions are affected by CVE-2024-46762?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-46762?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-46762 being exploited?
There is no known exploitation of CVE-2024-46762 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-49566, BELL-CVE-2024-46762, DEBIAN-CVE-2024-46762, GHSA-4366-c9hw-r9qg, ROOT-OS-DEBIAN-11-CVE-2024-46762, ROOT-OS-DEBIAN-12-CVE-2024-46762 and 2 more.