CVE-2024-46792

What it actually does

Missing access_ok() calls in raw_copy_to_user() and raw_copy_from_user() on RISC-V allow userspace to perform arbitrary kernel virtual memory reads and writes via misaligned accesses.

Why it matters to the business

Attackers can read sensitive kernel data or corrupt kernel structures on RISC-V Linux systems, leading to potential privilege escalation, information disclosure, or full system compromise; prevalence across the Linux kernel ecosystem increases exposure for affected deployments.

How an attack unfolds

An attacker with local user access crafts misaligned memory copy operations that skip standard address validation, directly targeting kernel memory regions to read secrets or inject malicious data without triggering access checks.

How to fix it

Update the Linux kernel to commit a3b6ff6c896aee5ef9b581e40d0045ff04fcbc8c or a later stable release that enforces access_ok() checks; for the nosurf Go package, upgrade to version 1.1.1.

How to confirm the fix worked

Verify the running kernel contains commit a3b6ff6c896aee5ef9b581e40d0045ff04fcbc8c, test that misaligned user copies now correctly fail on invalid kernel addresses, and review kernel build logs or version strings for the fix.

Typical attack path

1. Obtain local unprivileged access on a vulnerable RISC-V Linux system
2. Trigger misaligned raw copy operations from userspace to bypass access_ok()
3. Read or write arbitrary kernel virtual addresses to escalate privileges or extract data
4. Leverage gained access for further persistence or lateral movement

How to detect it

Review kernel audit logs and dmesg for unusual misaligned access patterns or failed copy attempts; examine process memory maps and strace output for suspicious raw copy calls targeting high kernel addresses; no widespread in-the-wild exploitation indicators are known.

What your security team should do

• Prioritize kernel upgrades on all RISC-V production systems before the next maintenance window
• Monitor vendor advisories for backported patches in distribution kernels
• Restrict unprivileged local access where feasible until patches are applied
• Include RISC-V kernel versions in asset inventories for future similar issues