CVE-2024-44968
published 2024-09-04CVE-2024-44968: In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Move per CPU pointer access into the atomic section The recent fix for…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.22%
12.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
tick/broadcast: Move per CPU pointer access into the atomic section
The recent fix for making the take over of the broadcast timer more
reliable retrieves a per CPU pointer in preemptible context.
This went unnoticed as compilers hoist the access into the non-preemptible
region where the pointer is actually used. But of course it's valid that
the compiler keeps it at the place where the code puts it which rightfully
triggers:
BUG: using smp_processor_id() in preemptible [00000000] code:
caller is hotplug_cpu__broadcast_tick_pull+0x1c/0xc0
Move it to the actual usage site which is in a non-preemptible region.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.106-1 (bookworm) | linux 6.1.106-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.106-1 (bookworm) | linux 6.1.106-1 (bookworm) |
| linux | linux | >= 2cdab4b4bf77369961f706cdeb7d040db10c5217 < 7dd12f85f150010ef7518201c63fa7e395f5c3e9 | 7dd12f85f150010ef7518201c63fa7e395f5c3e9 |
| linux | linux | >= 3a58c590f6bd1d20eb1e76c5cea31c36cc032339 < b9d604933d5fd72dd37f24e1dc35f778297d745a | b9d604933d5fd72dd37f24e1dc35f778297d745a |
| linux | linux | >= 408bfb6b0a7f22e971ce6b600aec448769e580a8 < 7b3ec186ba93e333e9efe7254e7e31c1828e5d2d | 7b3ec186ba93e333e9efe7254e7e31c1828e5d2d |
| linux | linux | >= 457a1c87d454455d671a3045cf0b56157be110a1 < f91fb47ecacc178a83a77eeebd25cbaec18c01d6 | f91fb47ecacc178a83a77eeebd25cbaec18c01d6 |
| linux | linux | >= 6.1.103 < 6.1.105 | 6.1.105 |
| linux | linux | >= 6.10.3 < 6.10.5 | 6.10.5 |
| linux | linux | >= 6.6.44 < 6.6.46 | 6.6.46 |
| linux | linux | >= 9ef7190228145f959d9bc0ddca40ecf76bb413b0 < 668c6c4a7e9e9f081c06b70f30104fb7013437ed | 668c6c4a7e9e9f081c06b70f30104fb7013437ed |
| linux | linux | >= d3b165c10473aa6fc6141bb5b1f6e5b50c1fb774 < 541a900d245536d4809cb1aa322c3fcc2cdb58a6 | 541a900d245536d4809cb1aa322c3fcc2cdb58a6 |
| linux | linux | >= dfe19aa91378972f10530635ad83b2d77f481044 < f54abf332a2bc0413cfa8bd6a8511f7aa99faea0 | f54abf332a2bc0413cfa8bd6a8511f7aa99faea0 |
| linux | linux | >= f7d43dd206e7e18c182f200e67a8db8c209907fa < 6881e75237a84093d0986f56223db3724619f26e | 6881e75237a84093d0986f56223db3724619f26e |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.226-1 | 5.10.226-1 |
| linux | linux_kernel | >= 0 < 6.1.106-1 | 6.1.106-1 |
| linux | linux_kernel | >= 0 < 6.10.6-1 | 6.10.6-1 |
| linux | linux_kernel | >= 0 < 6.10.6-1 | 6.10.6-1 |
| linux | linux_kernel | >= 6.1.103 < 6.1.105 | 6.1.105 |
| linux | linux_kernel | >= 6.10.3 < 6.10.5 | 6.10.5 |
| linux | linux_kernel | >= 6.6.44 < 6.6.46 | 6.6.46 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-285g-gc96-4xjh: In the Linux kernel, the following vulnerability has been resolved:
tick/broadcast: Move per CPU pointer access into the atomic section
The recent f
ghsa_unreviewed·2024-09-04
CVE-2024-44968 [MEDIUM] GHSA-285g-gc96-4xjh: In the Linux kernel, the following vulnerability has been resolved:
tick/broadcast: Move per CPU pointer access into the atomic section
The recent f
In the Linux kernel, the following vulnerability has been resolved:
tick/broadcast: Move per CPU pointer access into the atomic section
The recent fix for making the take over of the broadcast timer more
reliable retrieves a per CPU pointer in preemptible context.
This went unnoticed as compilers hoist the access into the non-preemptible
region where the pointer is actually used. But of course it's valid that
the compiler keeps it at the place where the code puts it which rightfully
triggers:
BUG: using smp_processor_id() in preemptible [00000000] code:
caller is hotplug_cpu__broadcast_tick_pull+0x1c/0xc0
Move it to the actual usage site which is in a non-preemptible region.
OSV
CVE-2024-44968: In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Move per CPU pointer access into the atomic section The recent fix
osv·2024-09-04·CVSS 5.5
CVE-2024-44968 [MEDIUM] CVE-2024-44968: In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Move per CPU pointer access into the atomic section The recent fix
In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Move per CPU pointer access into the atomic section The recent fix for making the take over of the broadcast timer more reliable retrieves a per CPU pointer in preemptible context. This went unnoticed as compilers hoist the access into the non-preemptible region where the pointer is actually used. But of course it's valid that the compiler keeps it at the place where the code puts it which rightfully triggers: BUG: using smp_processor_id() in preemptible [00000000] code: caller is hotplug_cpu__broadcast_tick_pull+0x1c/0xc0 Move it to the actual usage site which is in a non-preemptible region.
Red Hat
kernel: tick/broadcast: Move per CPU pointer access into the atomic section
vendor_redhat·2024-09-04·CVSS 5.5
CVE-2024-44968 [MEDIUM] CWE-367 kernel: tick/broadcast: Move per CPU pointer access into the atomic section
kernel: tick/broadcast: Move per CPU pointer access into the atomic section
In the Linux kernel, the following vulnerability has been resolved:
tick/broadcast: Move per CPU pointer access into the atomic section
The recent fix for making the take over of the broadcast timer more
reliable retrieves a per CPU pointer in preemptible context.
This went unnoticed as compilers hoist the access into the non-preemptible
region where the pointer is actually used. But of course it's valid that
the compiler keeps it at the place where the code puts it which rightfully
triggers:
BUG: using smp_processor_id() in preemptible [00000000] code:
caller is hotplug_cpu__broadcast_tick_pull+0x1c/0xc0
Move it to the actual usage site which is in a non-preemptible region.
Package: kernel (Red Hat Enterprise Li
Debian
CVE-2024-44968: linux - In the Linux kernel, the following vulnerability has been resolved: tick/broadc...
vendor_debian·2024·CVSS 5.5
CVE-2024-44968 [MEDIUM] CVE-2024-44968: linux - In the Linux kernel, the following vulnerability has been resolved: tick/broadc...
In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Move per CPU pointer access into the atomic section The recent fix for making the take over of the broadcast timer more reliable retrieves a per CPU pointer in preemptible context. This went unnoticed as compilers hoist the access into the non-preemptible region where the pointer is actually used. But of course it's valid that the compiler keeps it at the place where the code puts it which rightfully triggers: BUG: using smp_processor_id() in preemptible [00000000] code: caller is hotplug_cpu__broadcast_tick_pull+0x1c/0xc0 Move it to the actual usage site which is in a non-preemptible region.
Scope: local
bookworm: resolved (fixed in 6.1.106-1)
bullseye: resolved (fixed in 5.10.226-1)
forky: resolved (fixed
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/541a900d245536d4809cb1aa322c3fcc2cdb58a6https://git.kernel.org/stable/c/668c6c4a7e9e9f081c06b70f30104fb7013437edhttps://git.kernel.org/stable/c/6881e75237a84093d0986f56223db3724619f26ehttps://git.kernel.org/stable/c/7b3ec186ba93e333e9efe7254e7e31c1828e5d2dhttps://git.kernel.org/stable/c/7dd12f85f150010ef7518201c63fa7e395f5c3e9https://git.kernel.org/stable/c/b9d604933d5fd72dd37f24e1dc35f778297d745ahttps://git.kernel.org/stable/c/f54abf332a2bc0413cfa8bd6a8511f7aa99faea0https://git.kernel.org/stable/c/f91fb47ecacc178a83a77eeebd25cbaec18c01d6https://lists.debian.org/debian-lts-announce/2024/10/msg00003.htmlhttps://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
2024-09-04
Published