CVE-2024-46684

What it actually does

Incorrect AUXV entry count in create_elf_fdpic_tables() when ELF_HWCAP2 is defined causes the final AUX vector entry to be zeroed or triggers a kernel BUG after the prior auxv fix, resulting in memory corruption or kernel panic during ELF FDPIC binary loading.

Why it matters to the business

Systems running vulnerable kernels may experience unexpected crashes or instability when executing certain ELF binaries, leading to service outages and requiring urgent patching on affected Linux distributions.

How an attack unfolds

An attacker supplies a specially crafted ELF FDPIC binary on an architecture defining ELF_HWCAP2; during execve the kernel miscalculates AUXV space, either zeroing the terminator or hitting the BUG check and crashing the system.

How to fix it

Upgrade the Linux kernel to version 6.10.8 or later (or the equivalent stable backport containing commit c507da85e4f80c630deb9e98222ccf4118cbe6f8). Reboot affected systems after installation.

How to confirm the fix worked

Confirm the running kernel version is at least 6.10.8; attempt to execute an ELF FDPIC binary on an ELF_HWCAP2 architecture and verify no BUG or panic occurs; inspect /proc/<pid>/auxv for correct terminator after the fix.

Typical attack path

1. Identify or compile an ELF FDPIC binary for a target architecture with ELF_HWCAP2 defined
2. Place the binary in a location reachable by a privileged or user process
3. Trigger execution via execve or a service that loads the binary
4. Kernel BUG or memory corruption causes denial of service or potential escalation

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for BUG messages referencing create_elf_fdpic_tables or auxv after the September 2024 timeframe; correlate with execution of FDPIC binaries.

What your security team should do

• Prioritize kernel updates to 6.10.8+ on all production systems within the next maintenance window
• Monitor kernel logs for 'kernel BUG' entries related to binfmt_elf_fdpic during the remediation period
• Restrict execution of untrusted ELF binaries until patches are applied