CVE-2024-45002

What it actually does

NULL pointer dereference in osnoise_free_top() when tool->data allocation fails during error handling in the rtla/osnoise subsystem.

Why it matters to the business

Kernel crashes or instability during low-memory conditions when using real-time analysis tools, disrupting debugging and performance monitoring workflows; high downstream Linux kernel prevalence increases broad operational risk.

How an attack unfolds

An attacker or process triggers the rtla tool under memory pressure to force the allocation failure path, leading to the erroneous call to osnoise_free_top() and resulting NULL dereference crash; listed threat actors in zero-day and Linux kernel campaigns could leverage similar resource manipulation.

How to fix it

Update Linux kernel to commit fc575212c6b75d538e1a0a74f4c7e2ac73bc46ac or later stable releases; for listed Vault packages apply fixes in versions 1.12.11, 1.13.7 or 1.14.3 where applicable.

How to confirm the fix worked

Confirm kernel source contains the resolved error-handling check before osnoise_free_top() call; test allocation failure scenarios to ensure no dereference occurs.

Typical attack path

1. Identify target system running vulnerable kernel with rtla/osnoise enabled
2. Induce memory exhaustion to cause tool->data allocation failure
3. Trigger error handling path that incorrectly invokes osnoise_free_top()
4. Cause NULL dereference leading to kernel panic or denial of service

How to detect it

Review kernel logs for NULL dereference oops in rtla/osnoise paths; correlate with memory allocation failure events around tool initialization; no widespread exploitation reported given false KEV status.

What your security team should do

• Prioritize kernel upgrades on all affected systems due to 768 days since publication and stable but persistent EPSS
• Monitor for memory pressure events in environments using rtla tools
• Apply listed fixed versions immediately where kernel or Vault packages are present