CVE-2024-26946: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address
In the Linux kernel, the following vulnerability has been resolved:
kprobes/x86: Use copyfromkernelnofault() to read from unsafe address
Read from an unsafe address with copyfromkernelnofault() in archadjustkprobeaddr() because this function is used before checking the address is in text or not. Syzcaller bot found a bug and reported the case if user specifies inaccessible data area, archadjustkprobeaddr() will cause a kernel panic.
[ mingo: Clarified the comment. ]
Other sources
In the Linux kernel, the following vulnerability has been resolved:
kprobes/x86: Use copyfromkernelnofault() to read from unsafe address
The Linux kernel CVE team has assigned CVE-2024-26946 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050126-CVE-2024-26946-ad5d@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26946?
CVE-2024-26946 has been classified with a high severity level due to the potential risk of reading from unsafe memory addresses.
How do I fix CVE-2024-26946?
To fix CVE-2024-26946, update to the patched kernel versions 6.1.84, 6.6.24, 6.7.12, 6.8.3, or 6.9 for Red Hat, or to the specified versions for Debian.
Which Linux kernel versions are affected by CVE-2024-26946?
CVE-2024-26946 affects multiple versions of the Linux kernel prior to the specified patched versions.
What systems are at risk from CVE-2024-26946?
Systems running vulnerable versions of the Linux kernel, particularly those in Red Hat and Debian distributions, are at risk from CVE-2024-26946.
Is CVE-2024-26946 being actively exploited?
As of now, there is no public information indicating that CVE-2024-26946 is being actively exploited in the wild.