CVE-2024-57934: fgraph: Add READ_ONCE() when accessing fgraph_array[]
In the Linux kernel, the following vulnerability has been resolved:
fgraph: Add READONCE() when accessing fgrapharray[]
In ftracereturntohandler(), a loop iterates over the fgrapharray[] elements, which are fgraphops. The loop checks if an element is a fgraphstub to prevent using a fgraphstub afterward.
However, if the compiler reloads fgrapharray[] after this check, it might race with an update to fgrapharray[] that introduces a fgraphstub. This could result in the stub being processed, but the stub contains a null "funchash" field, leading to a NULL pointer dereference.
To ensure that the gops compared against the fgraphstub matches the gops processed later, add a READONCE(). A similar patch appears in commit 63a8dfb ("functiongraph: Add READONCE() when accessing fgrapharray[]").
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-57934?
CVE-2024-57934 is considered a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-57934?
To fix CVE-2024-57934, update the Linux kernel to the latest stable version that contains the patch.
What systems are affected by CVE-2024-57934?
CVE-2024-57934 affects the Linux kernel across multiple distributions that utilize this version.
Can CVE-2024-57934 be exploited remotely?
CVE-2024-57934 does not appear to be exploitable remotely as it requires local access to the system.
What impact does CVE-2024-57934 have on system security?
CVE-2024-57934 could potentially lead to unauthorized access to sensitive data or system resources.