{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-36963", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-30T15:25:07.081Z", "datePublished": "2024-06-03T07:50:01.125Z", "dateUpdated": "2026-08-05T11:32:17.919Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:32:17.919Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracefs: Reset permissions on remount if permissions are options\n\nThere's an inconsistency with the way permissions are handled in tracefs.\nBecause the permissions are generated when accessed, they default to the\nroot inode's permission if they were never set by the user. If the user\nsets the permissions, then a flag is set and the permissions are saved via\nthe inode (for tracefs files) or an internal attribute field (for\neventfs).\n\nBut if a remount happens that specify the permissions, all the files that\nwere not changed by the user gets updated, but the ones that were are not.\nIf the user were to remount the file system with a given permission, then\nall files and directories within that file system should be updated.\n\nThis can cause security issues if a file's permission was updated but the\nadmin forgot about it. They could incorrectly think that remounting with\npermissions set would update all files, but miss some.\n\nFor example:\n\n # cd /sys/kernel/tracing\n # chgrp 1002 current_tracer\n # ls -l\n[..]\n -rw-r----- 1 root root 0 May 1 21:25 buffer_size_kb\n -rw-r----- 1 root root 0 May 1 21:25 buffer_subbuf_size_kb\n -r--r----- 1 root root 0 May 1 21:25 buffer_total_size_kb\n -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer\n -rw-r----- 1 root root 0 May 1 21:25 dynamic_events\n -r--r----- 1 root root 0 May 1 21:25 dyn_ftrace_total_info\n -r--r----- 1 root root 0 May 1 21:25 enabled_functions\n\nWhere current_tracer now has group \"lkp\".\n\n # mount -o remount,gid=1001 .\n # ls -l\n -rw-r----- 1 root tracing 0 May 1 21:25 buffer_size_kb\n -rw-r----- 1 root tracing 0 May 1 21:25 buffer_subbuf_size_kb\n -r--r----- 1 root tracing 0 May 1 21:25 buffer_total_size_kb\n -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer\n -rw-r----- 1 root tracing 0 May 1 21:25 dynamic_events\n -r--r----- 1 root tracing 0 May 1 21:25 dyn_ftrace_total_info\n -r--r----- 1 root tracing 0 May 1 21:25 enabled_functions\n\nEverything changed but the \"current_tracer\".\n\nAdd a new link list that keeps track of all the tracefs_inodes which has\nthe permission flags that tell if the file/dir should use the root inode's\npermission or not. Then on remount, clear all the flags so that the\ndefault behavior of using the root inode's permission is done for all\nfiles and directories." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The flaw is reached through ordinary filesystem operations on tracefs (open/read/write/stat, chown) at /sys/kernel/tracing, which requires a local account on the system. There is no network-reachable path to tracefs permission handling.\nAC:L - The stale-permission condition is deterministic — no race, no memory-layout or timing dependency — and the attacker can set the pinning flag themselves, since fs/attr.c:chown_ok() allows an owner's no-op self-chown and chgrp_ok() allows an owner chgrp to their own group, so a granted user can pin every tracefs file at will. Remounting with uid=/gid= is the documented, routinely used way to manage tracefs ownership, so the exploited state arises in normal administration.\nPR:L - The attacker needs only an unprivileged local account that holds (or previously held) tracefs access via the uid=/gid= mount option or the tracing group; no CAP_SYS_ADMIN, CAP_CHOWN or root is required, because setting the pinning flag is permitted to the file's own owner. Root privileges are never needed on the attacker's side.\nUI:N - Once the file system is in the vulnerable state, the attacker simply exercises retained read/write access to tracefs with no action required from any other user. The administrator's remount is a routine configuration operation that establishes the state, not an attacker-induced victim interaction at exploitation time.\nS:U - The unauthorized access and its consequences stay within the kernel/OS security authority managing tracefs; no VM, IOMMU, or container-host boundary is crossed.\nC:H - Retained access to tracefs yields the ring buffer (`trace`, `trace_pipe`, `trace_pipe_raw`) containing kernel addresses and other processes' syscall data, and writable `kprobe_events`/`dynamic_events` gives probe fetch arguments that dereference and dump arbitrary kernel memory — an effective arbitrary kernel-read primitive that also defeats KASLR.\nI:H - Group/owner write access is retained on 0640 control files, letting the attacker install kprobes/uprobes, switch tracers, rewrite `set_ftrace_filter` and event filters/triggers, and clear or inject ring-buffer records — modifying kernel-wide tracing behavior and destroying trace/audit evidence that the administrator believed was locked down.\nA:H - Retained write access to `buffer_size_kb`/per-CPU `buffer_size_kb` permits allocating enormous per-CPU ring buffers leading to memory exhaustion and OOM kills, and enabling global function/function_graph tracing degrades the entire system, so a complete denial of service is achievable." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/tracefs/event_inode.c", "fs/tracefs/inode.c", "fs/tracefs/internal.h" ], "versions": [ { "version": "628adb842bd5e1c2c598534a7a022b8235289de6", "lessThan": "5f91fc82794d4a6e41cdcd02d00baa377d94ca78", "status": "affected", "versionType": "git" }, { "version": "8186fff7ab649085e2c60d032d9a20a85af1d87c", "lessThan": "414fb08628143203d29ccd0264b5a83fb9523c03", "status": "affected", "versionType": "git" }, { "version": "8186fff7ab649085e2c60d032d9a20a85af1d87c", "lessThan": "baa23a8d4360d981a49913841a726edede5cdd54", "status": "affected", "versionType": "git" }, { "version": "9c2ac5e0ea7899411fd900d4681890722a020735", "status": "affected", "versionType": "git" }, { "version": "6.6.18", "lessThan": "6.6.31", "status": "affected", "versionType": "semver" }, { "version": "6.7.4", "lessThan": "6.8", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/tracefs/event_inode.c", "fs/tracefs/inode.c", "fs/tracefs/internal.h" ], "versions": [ { "version": "6.8", "status": "affected" }, { "version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.31", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.10", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.18", "versionEndExcluding": "6.6.31" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.8.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7.4" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/5f91fc82794d4a6e41cdcd02d00baa377d94ca78" }, { "url": "https://git.kernel.org/stable/c/414fb08628143203d29ccd0264b5a83fb9523c03" }, { "url": "https://git.kernel.org/stable/c/baa23a8d4360d981a49913841a726edede5cdd54" } ], "title": "tracefs: Reset permissions on remount if permissions are options", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-863", "lang": "en", "description": "CWE-863 Incorrect Authorization" } ] } ], "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "timestamp": "2025-05-20T14:06:38.590905Z", "id": "CVE-2024-36963", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-20T14:07:59.778Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.371Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/5f91fc82794d4a6e41cdcd02d00baa377d94ca78", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/414fb08628143203d29ccd0264b5a83fb9523c03", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/baa23a8d4360d981a49913841a726edede5cdd54", "tags": [ "x_transferred" ] } ] } ] } }