CVE-2024-46713

What it actually does

Race condition in perf AUX buffer handling where event->mmap_mutex provides insufficient serialization, allowing concurrent access that can corrupt ring buffer state.

Why it matters to the business

Kernel subsystems handling performance data may experience crashes, data corruption, or local privilege escalation on affected Linux systems; widespread kernel deployment increases exposure across servers, containers, and embedded devices.

How an attack unfolds

An attacker with local access triggers concurrent perf event mmap operations and AUX buffer reads/writes, bypassing the insufficient mmap_mutex to race on the ring buffer and achieve memory corruption or unauthorized data access.

How to fix it

Update the Linux kernel to a version containing commit 7882923f1cb88dc1a17f2bf0c81b1fc80d44db82 or later; for k8s.io/kubernetes deployments apply fixes in versions 1.9.10, 1.10.6, or 1.11.2.

How to confirm the fix worked

Verify the running kernel contains commit 7882923f1cb88dc1a17f2bf0c81b1fc80d44db82 via git log or uname; test perf AUX tracing under concurrent mmap load to confirm serialization.

Typical attack path

1. Obtain local unprivileged access on a vulnerable Linux system
2. Create multiple perf events configured for AUX tracing
3. Concurrently invoke mmap and AUX buffer operations from multiple threads
4. Exploit the missing per-RB mutex to corrupt ring buffer metadata
5. Escalate to kernel code execution or information disclosure

How to detect it

Review kernel crash logs and perf-related oops for ring buffer corruption patterns; inspect audit logs for unusual perf_event_open calls from untrusted processes around the time of anomalies.

What your security team should do

• Prioritize kernel updates on all production systems within standard change windows
• Monitor upstream stable branches for backports of the AUX buffer mutex fix
• Restrict unprivileged perf_event_paranoid settings where possible until patched