CVE-2024-56675

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74

Description The issue is related to a use-after-free (UAF) vulnerability in the Linux kernel's BPF uprobe attachments. Uprobes use bpf prog run array uprobe() under tasks-trace-RCU protection, but it is possible to attach a non-sleepable BPF program to a uprobe. Non-sleepable BPF programs are freed via normal RCU, which can lead to UAF of the bpf prog because a normal RCU grace period does not imply a tasks-trace-RCU grace period. The vulnerability can be exploited to impact the confidentiality, integrity, and availability of protected information.

Recommendations To resolve the issue, update the Linux kernel to version 6.6.74 or later. As a temporary workaround, consider restricting the use of non-sleepable BPF programs with uprobe attachments until a patch is available. Avoid using the bpf prog run array uprobe() function under tasks-trace-RCU protection with non-sleepable BPF programs.