{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-43891", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-17T09:11:59.290Z", "datePublished": "2024-08-26T10:10:44.790Z", "dateUpdated": "2026-08-05T11:37:00.918Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:37:00.918Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Have format file honor EVENT_FILE_FL_FREED\n\nWhen eventfs was introduced, special care had to be done to coordinate the\nfreeing of the file meta data with the files that are exposed to user\nspace. The file meta data would have a ref count that is set when the file\nis created and would be decremented and freed after the last user that\nopened the file closed it. When the file meta data was to be freed, it\nwould set a flag (EVENT_FILE_FL_FREED) to denote that the file is freed,\nand any new references made (like new opens or reads) would fail as it is\nmarked freed. This allowed other meta data to be freed after this flag was\nset (under the event_mutex).\n\nAll the files that were dynamically created in the events directory had a\npointer to the file meta data and would call event_release() when the last\nreference to the user space file was closed. This would be the time that it\nis safe to free the file meta data.\n\nA shortcut was made for the \"format\" file. It's i_private would point to\nthe \"call\" entry directly and not point to the file's meta data. This is\nbecause all format files are the same for the same \"call\", so it was\nthought there was no reason to differentiate them. The other files\nmaintain state (like the \"enable\", \"trigger\", etc). But this meant if the\nfile were to disappear, the \"format\" file would be unaware of it.\n\nThis caused a race that could be trigger via the user_events test (that\nwould create dynamic events and free them), and running a loop that would\nread the user_events format files:\n\nIn one console run:\n\n # cd tools/testing/selftests/user_events\n # while true; do ./ftrace_test; done\n\nAnd in another console run:\n\n # cd /sys/kernel/tracing/\n # while true; do cat events/user_events/__test_event/format; done 2>/dev/null\n\nWith KASAN memory checking, it would trigger a use-after-free bug report\n(which was a real bug). This was because the format file was not checking\nthe file's meta data flag \"EVENT_FILE_FL_FREED\", so it would access the\nevent that the file meta data pointed to after the event was freed.\n\nAfter inspection, there are other locations that were found to not check\nthe EVENT_FILE_FL_FREED flag when accessing the trace_event_file. Add a\nnew helper function: event_file_file() that will make sure that the\nevent_mutex is held, and will return NULL if the trace_event_file has the\nEVENT_FILE_FL_FREED flag set. Have the first reference of the struct file\npointer use event_file_file() and check for NULL. Later uses can still use\nthe event_file_data() helper function if the event_mutex is still held and\nwas not released since the event_file_file() call." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable paths are tracefs files under /sys/kernel/tracing/events/ reached by open/read/write/ioctl on a local mount, plus the user_events_data ioctl used to free the event. There is no network or adjacent-network path into the ftrace event layer.\nAC:L - The attacker controls both sides and no race is required — the format fd holds no reference and i_private is never cleared, so opening the file, deleting the dynamic event via DIAG_IOCSDEL or dynamic_events, then reading yields the use-after-free deterministically.\nPR:L - Only an unprivileged local account with tracefs access is needed; user_events is explicitly designed for relaxed permissions (the kernel comment cites \"'other' has read/write access to user_events_data/status\"), and Android/Perfetto, ChromeOS and developer systems routinely grant tracefs to a non-root group. No real root or CAP_SYS_ADMIN is required.\nUI:N - The attacker performs the event registration, deletion and file read entirely from their own process. No victim action or cooperating user is involved.\nS:U - The use-after-free happens in kernel context on the same host and does not cross a virtualization, IOMMU or sandbox boundary. Impact stays within the kernel's own security authority.\nC:H - f_show() prints call->print_fmt, field->type and field->name as %s from the freed trace_event_call and its freed field list, copying reclaimed slab contents directly into the user's read() buffer. Grooming the freed object with attacker-controlled data turns print_fmt into an arbitrary kernel pointer, giving an arbitrary-read disclosure primitive.\nI:H - The same commit fixes write paths that operated on a freed trace_event_file — apply_event_filter() does rcu_assign_pointer(file->filter, ...) and trigger registration does list_add_rcu(&data->list, &file->triggers) and file->flags |= into freed memory. A UAF write into a reclaimed slab object is a heap-corruption primitive usable for control-flow hijack.\nA:H - KASAN confirmed a real use-after-free; dereferencing the freed call and walking its freed field list under event_mutex readily oopses the kernel. The condition is trivially repeatable, so it is a reliable denial of service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/trace/trace.h", "kernel/trace/trace_events.c", "kernel/trace/trace_events_hist.c", "kernel/trace/trace_events_inject.c", "kernel/trace/trace_events_trigger.c" ], "versions": [ { "version": "14aa4f3efc6e784847e8c8543a7ef34ec9bdbb01", "lessThan": "4ed03758ddf0b19d69eed69386d65a92d0091e0c", "status": "affected", "versionType": "git" }, { "version": "b63db58e2fa5d6963db9c45df88e60060f0ff35f", "lessThan": "531dc6780d94245af037c25c2371c8caf652f0f9", "status": "affected", "versionType": "git" }, { "version": "b63db58e2fa5d6963db9c45df88e60060f0ff35f", "lessThan": "b1560408692cd0ab0370cfbe9deb03ce97ab3f6d", "status": "affected", "versionType": "git" }, { "version": "6.6.33", "lessThan": "6.6.49", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/trace/trace.h", "kernel/trace/trace_events.c", "kernel/trace/trace_events_hist.c", "kernel/trace/trace_events_inject.c", "kernel/trace/trace_events_trigger.c" ], "versions": [ { "version": "6.9", "status": "affected" }, { "version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.49", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.5", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.33", "versionEndExcluding": "6.6.49" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.10.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/4ed03758ddf0b19d69eed69386d65a92d0091e0c" }, { "url": "https://git.kernel.org/stable/c/531dc6780d94245af037c25c2371c8caf652f0f9" }, { "url": "https://git.kernel.org/stable/c/b1560408692cd0ab0370cfbe9deb03ce97ab3f6d" } ], "title": "tracing: Have format file honor EVENT_FILE_FL_FREED", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-43891", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T15:29:22.295437Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:32:58.118Z" } } ] } }