CVE-2024-56706CWE-125CWE-362

CVE-2024-56706

High · published December 28, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
5.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

s390/cpum_sf: Fix and protect memory allocation of SDBs with mutex

Reservation of the PMU hardware is done at first event creation

and is protected by a pair of mutex_lock() and mutex_unlock().

After reservation of the PMU hardware the memory

required for the PMUs the event is to be installed on is

allocated by allocate_buffers() and alloc_sampling_buffer().

This done outside of the mutex protection.

Without mutex protection two or more concurrent invocations of

perf_event_init() may run in parallel.

This can lead to allocation of Sample Data Blocks (SDBs)

multiple times for the same PMU.

Prevent this and protect memory allocation of SDBs by

mutex.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00166 · 5.6th percentile
Weaknesses
CWE-125 · Out-of-bounds Read; CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2024-12-28T15:15Z
Affected products (1)
ProductVersionsFixed in
linux/linux_kernel≥ 6.12, < 6.12.26.12.2
References (2)
EPSS history
Timeline
  • 28 DEC 09:46Z
    s390/cpum_sf: Fix and protect memory allocation of SDBs with mutex
    cvelistv5