CVE-2024-46845

What it actually does

Use-after-free in Linux kernel tracing/timerlat where hrtimer is shutdown and freed twice due to asynchronous user space thread termination via SIGTERM combined with new tracing instance resets before full closure.

Why it matters to the business

Kernel instability, crashes, or potential privilege escalation on Linux systems using timerlat for latency monitoring; low immediate risk given low EPSS and no KEV status but impacts production kernel reliability and observability tooling.

How an attack unfolds

Attacker terminates timerlat user space threads with SIGTERM then starts a new tracing instance to reset state before old threads fully close file descriptors, triggering double-free of the associated hrtimer; context from 2024 zero-day espionage and financially motivated campaigns plus Linux kernel UAF and OOB write patterns may inform similar exploitation attempts.

How to fix it

Update Linux kernel to commit 8c72f0b2c45f21cb8b00fc37f79f632d7e46c2ed or equivalent stable branch; update github.com/fluxcd/kustomize-controller to 0.15.0 if present in environment; apply interface_lock around kthread reset as additional hardening.

How to confirm the fix worked

Confirm kernel contains the timerlat hrtimer cancel check and interface_lock; review dmesg and tracing logs for absence of double-free warnings after thread shutdown tests; verify fixed version strings in /proc/version or package metadata.

Typical attack path

1. Identify system running timerlat tracer with user space threads
2. Send SIGTERM to terminate threads one at a time
3. Immediately start new tracing instance to reset kthread references
4. Allow dying threads to close file descriptors triggering double hrtimer free
5. Exploit resulting use-after-free for denial of service or code execution

How to detect it

Search kernel logs and dmesg for timerlat or hrtimer related use-after-free oops/panics; correlate process termination events with new tracing instance creation; review for indicators from listed 2024 zero-day campaigns targeting Linux kernel flaws.

What your security team should do

• Prioritize kernel upgrade on all affected Linux distributions within standard patch cycles
• Temporarily disable timerlat tracer on non-essential systems until patched
• Monitor EPSS and threat actor reports for any increase in Linux kernel UAF exploitation
• Audit custom tracing workloads that spawn user space timerlat threads