CVE-2024-45021

What it actually does

The memcg_write_event_control() function in the Linux kernel reads past the terminating NUL byte of user-supplied input without verifying that the following memory is mapped or initialized, resulting in an oops due to invalid memory access.

Why it matters to the business

Local users can trigger kernel crashes on affected Linux systems, causing denial of service and operational disruption; the stable low EPSS and lack of KEV listing indicate limited in-the-wild exploitation risk despite broad kernel exposure.

How an attack unfolds

A local attacker writes a specially crafted string ending in NUL to the memory cgroup event control file; the kernel proceeds to access unmapped memory beyond the NUL, triggering the oops. Listed threat actor campaigns have targeted similar recent kernel privilege-escalation issues but no confirmed exploitation of this specific flaw is recorded.

How to fix it

Upgrade the Linux kernel to commit fa5bfdf6cb5846a00e712d630a43e3cf55ccb411 or later stable releases containing the fix; for the related Go yaml.v2 package update to version 2.2.3 or newer.

How to confirm the fix worked

Confirm the running kernel contains commit fa5bfdf6cb5846a00e712d630a43e3cf55ccb411; attempt to reproduce the original oops condition with a test payload and verify the system no longer crashes.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Locate the memory cgroup event_control interface
3. Write a NUL-terminated payload crafted to read past the terminator
4. Trigger the kernel oops and system instability

How to detect it

Review kernel logs for oops entries referencing memcg_write_event_control or memory cgroup event control writes; correlate with user activity on cgroup filesystems around the time of crashes.

What your security team should do

• Prioritize kernel updates on all Linux hosts within the published remediation window
• Monitor EPSS and KEV status for any change in exploit maturity
• Restrict untrusted local users from cgroup interfaces where feasible until patched