CVE-2024-46845
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-46845
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-46845.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-46845
- Downstream
- Related
- Published
- 2024-09-27T12:39:38Z
- Modified
- 2025-10-14T23:16:16.435232Z
- Summary
- tracing/timerlat: Only clear timer if a kthread exists
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
tracing/timerlat: Only clear timer if a kthread exists
The timerlat tracer can use user space threads to check for osnoise and timer latency. If the program using this is killed via a SIGTERM, the threads are shutdown one at a time and another tracing instance can start up resetting the threads before they are fully closed. That causes the hrtimer assigned to the kthread to be shutdown and freed twice when the dying thread finally closes the file descriptors, causing a use-after-free bug.
Only cancel the hrtimer if the associated thread is still around. Also add the interfacelock around the resetting of the tlatvar->kthread.
Note, this is just a quick fix that can be backported to stable. A real fix is to have a better synchronization between the shutdown of old threads and the starting of new ones.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede88ed227f639ebcb31ed4e5b88756b47d904584bFixed8c72f0b2c45f21cb8b00fc37f79f632d7e46c2ed
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede88ed227f639ebcb31ed4e5b88756b47d904584bFixed8a9d0d405159e9c796ddf771f7cff691c1a2bc1e
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede88ed227f639ebcb31ed4e5b88756b47d904584bFixede6a53481da292d970d1edf0d8831121d1c5e2f0d
Affected versions
v6.*
v6.10
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.10.1
v6.10.2
v6.10.3
v6.10.4
v6.10.5
v6.10.6
v6.10.7
v6.10.8
v6.10.9
v6.11-rc1
v6.11-rc2
v6.11-rc3
v6.11-rc4
v6.4
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.18
v6.6.19
v6.6.2
v6.6.20
v6.6.21
v6.6.22
v6.6.23
v6.6.24
v6.6.25
v6.6.26
v6.6.27
v6.6.28
v6.6.29
v6.6.3
v6.6.30
v6.6.31
v6.6.32
v6.6.33
v6.6.34
v6.6.35
v6.6.36
v6.6.37
v6.6.38
v6.6.39
v6.6.4
v6.6.40
v6.6.41
v6.6.42
v6.6.43
v6.6.44
v6.6.45
v6.6.46
v6.6.47
v6.6.48
v6.6.49
v6.6.5
v6.6.50
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7
Database specific
vanir_signatures
[
{
"signature_type": "Function",
"id": "CVE-2024-46845-18a7f7b3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c72f0b2c45f21cb8b00fc37f79f632d7e46c2ed",
"signature_version": "v1",
"target": {
"function": "tlat_var_reset",
"file": "kernel/trace/trace_osnoise.c"
},
"digest": {
"function_hash": "174131029877543952906738732700711290512",
"length": 203.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-46845-1ad88a1b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a9d0d405159e9c796ddf771f7cff691c1a2bc1e",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace_osnoise.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"156806254355250489557169468616296601576",
"309867551316569116109473307367233165799",
"52316023681305020686169260039784558280",
"266977280903828644315858471968171375387",
"40246922342487612012022751569149514453",
"224522680501999668414566833160699337780",
"153193283280528753301955382710836696035",
"269564446303495820601791468043195839148",
"122759136605658251522136140547591491990",
"253139458040074704673067925741118294678",
"244126087626819471940671638908966075987",
"233712941009889147706340846508599011913",
"71963694645663910505392272533667259739",
"260864604948811381506717645271320513010",
"109658808415560598515149727364936222340",
"4524394124842356924531981168407088803",
"295927827203406622646143999116129429390",
"81085945089995348869502230291342191092",
"73858148061009198793046808148216640688"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-46845-1e692783",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a9d0d405159e9c796ddf771f7cff691c1a2bc1e",
"signature_version": "v1",
"target": {
"function": "timerlat_fd_release",
"file": "kernel/trace/trace_osnoise.c"
},
"digest": {
"function_hash": "177164570571006600430257177967350533753",
"length": 528.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-46845-57e53702",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c72f0b2c45f21cb8b00fc37f79f632d7e46c2ed",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace_osnoise.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"156806254355250489557169468616296601576",
"309867551316569116109473307367233165799",
"52316023681305020686169260039784558280",
"266977280903828644315858471968171375387",
"40246922342487612012022751569149514453",
"224522680501999668414566833160699337780",
"153193283280528753301955382710836696035",
"269564446303495820601791468043195839148",
"122759136605658251522136140547591491990",
"253139458040074704673067925741118294678",
"244126087626819471940671638908966075987",
"233712941009889147706340846508599011913",
"71963694645663910505392272533667259739",
"260864604948811381506717645271320513010",
"109658808415560598515149727364936222340",
"4524394124842356924531981168407088803",
"295927827203406622646143999116129429390",
"81085945089995348869502230291342191092",
"73858148061009198793046808148216640688"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-46845-72060ee4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e6a53481da292d970d1edf0d8831121d1c5e2f0d",
"signature_version": "v1",
"target": {
"function": "tlat_var_reset",
"file": "kernel/trace/trace_osnoise.c"
},
"digest": {
"function_hash": "174131029877543952906738732700711290512",
"length": 203.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-46845-786ce1c5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e6a53481da292d970d1edf0d8831121d1c5e2f0d",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace_osnoise.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"156806254355250489557169468616296601576",
"309867551316569116109473307367233165799",
"52316023681305020686169260039784558280",
"266977280903828644315858471968171375387",
"40246922342487612012022751569149514453",
"224522680501999668414566833160699337780",
"153193283280528753301955382710836696035",
"269564446303495820601791468043195839148",
"122759136605658251522136140547591491990",
"253139458040074704673067925741118294678",
"244126087626819471940671638908966075987",
"233712941009889147706340846508599011913",
"71963694645663910505392272533667259739",
"260864604948811381506717645271320513010",
"109658808415560598515149727364936222340",
"4524394124842356924531981168407088803",
"295927827203406622646143999116129429390",
"81085945089995348869502230291342191092",
"73858148061009198793046808148216640688"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-46845-9a41db11",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c72f0b2c45f21cb8b00fc37f79f632d7e46c2ed",
"signature_version": "v1",
"target": {
"function": "timerlat_fd_release",
"file": "kernel/trace/trace_osnoise.c"
},
"digest": {
"function_hash": "177164570571006600430257177967350533753",
"length": 528.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-46845-a7a9ac42",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e6a53481da292d970d1edf0d8831121d1c5e2f0d",
"signature_version": "v1",
"target": {
"function": "timerlat_fd_release",
"file": "kernel/trace/trace_osnoise.c"
},
"digest": {
"function_hash": "177164570571006600430257177967350533753",
"length": 528.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-46845-fe931c6a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a9d0d405159e9c796ddf771f7cff691c1a2bc1e",
"signature_version": "v1",
"target": {
"function": "tlat_var_reset",
"file": "kernel/trace/trace_osnoise.c"
},
"digest": {
"function_hash": "174131029877543952906738732700711290512",
"length": 203.0
},
"deprecated": false
}
]