CVE-2024-46801

What it actually does

The vulnerability allows a use-after-free condition in get_stashed_dentry() because the function used READ_ONCE() instead of rcu_dereference() when accessing a stashed dentry pointer, failing to ensure proper RCU protection before dereference.

Why it matters to the business

Organizations running affected Linux kernels or dependent Kubernetes deployments face elevated risk of local privilege escalation or system instability until kernels are updated, potentially affecting container orchestration reliability and requiring prioritized patching across large fleets.

How an attack unfolds

An attacker with local access triggers a race condition where a dentry is freed while another thread still holds a reference obtained without RCU read-side critical section, leading to dereference of a freed object and potential arbitrary code execution or kernel panic.

How to fix it

Update to Linux kernel commit 03e2a1209a83a380df34a72f7d6d1bc6c74132c7 or later, or upgrade Kubernetes to 1.20.0-alpha.1 or newer versions that incorporate the fixed kernel.

How to confirm the fix worked

Verify the running kernel contains commit 03e2a1209a83a380df34a72f7d6d1bc6c74132c7 by checking /proc/version or kernel source, and confirm Kubernetes nodes report version 1.20.0-alpha.1 or higher.

Typical attack path

1. Obtain local unprivileged access on an affected Linux system
2. Craft concurrent operations that race the stashed dentry lookup and free paths
3. Trigger use-after-free dereference via the unprotected READ_ONCE access
4. Leverage the resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for dentry-related warnings or crashes around stashed dentry operations; examine audit logs for unusual local process activity coinciding with kernel oops or use-after-free reports.

What your security team should do

• Prioritize kernel and Kubernetes upgrades on all affected systems within standard change windows
• Monitor vendor advisories for backported fixes in distribution kernels
• Restrict local user access on high-value systems until patches are applied