CVE-2024-39470

What it actually does

Null pointer dereference in eventfs_find_events() when ei is NULL before update_events_attr() operates on ei members, or when ei->is_freed is set, allowing invalid memory access in the Linux kernel event tracing subsystem.

Why it matters to the business

Kernel instability or crashes on systems using event tracing, leading to denial of service; widespread impact due to Linux kernel prevalence in servers, embedded devices, and Android ecosystems, with potential for local privilege escalation if memory corruption is leveraged.

How an attack unfolds

An attacker with local access triggers eventfs operations that reach eventfs_find_events() with a freed or NULL ei struct (possibly via crafted trace event interactions), causing the null dereference; threat actor context includes Android kernel remote code execution attempts that could chain this into broader compromise.

How to fix it

Upgrade Linux kernel to version 6.6.34 or apply commit 5ade5fbdbbb1f023bb70730ba4d74146c8bc7eb9 in stable trees; rebuild and reboot affected systems, prioritizing those in Android or high-availability environments.

How to confirm the fix worked

Verify kernel version post-upgrade matches fixed releases; inspect eventfs code for the added NULL check on ei->is_freed before update_events_attr(); run kernel regression tests exercising trace event registration and lookup paths.

Typical attack path

1. Obtain local access or execute code in a container/trace-enabled context on a vulnerable Linux kernel
2. Interact with eventfs to invoke eventfs_find_events() under conditions where ei is NULL or marked freed
3. Trigger update_events_attr() on the invalid ei pointer to dereference null memory
4. Exploit resulting crash, panic, or memory corruption for denial of service or escalation

How to detect it

Search kernel logs for null pointer dereference oops in eventfs_find_events or update_events_attr; look for unusual trace event registration attempts preceding crashes, especially on Android or systems with heavy ftrace usage.

What your security team should do

• Apply kernel updates to 6.6.34 or equivalent immediately on production systems
• Monitor for kernel oops/panic logs related to eventfs
• Restrict unprivileged access to tracefs and event tracing interfaces until patched
• Review downstream Android and embedded device images for the same kernel vulnerability