CVE-2024-46847

What it actually does

Race condition in new_vmap_block() where a partially-initialised vmap_block structure (with uninitialised 'cpu' field) is inserted into the local vmap_block_queue xarray before initialisation completes, allowing concurrent access via vm_unmap_aliases() to perform an out-of-bounds array index read on a remote CPU's queue.

Why it matters to the business

Kernel instability and potential crashes during memory alias unmapping operations, module loading, or set_memory_ro calls on Linux systems, increasing operational risk and requiring urgent patching on affected kernels despite low exploit probability.

How an attack unfolds

An attacker with the ability to trigger concurrent module initialisation or memory permission changes on a multi-CPU system can race with new_vmap_block() to cause an out-of-bounds access in purge_fragmented_block(), observed as UBSAN array index errors; no public exploits or threat actor campaigns are known.

How to fix it

Update the Linux kernel to the commit 0c3836482481200ead7b416ca80c68a29cfdaabd or later; rebuild and reboot systems with the patched kernel; apply vendor backports where available.

How to confirm the fix worked

Verify the running kernel contains commit 0c3836482481200ead7b416ca80c68a29cfdaabd; reproduce module loading under memory pressure while monitoring for absence of prior UBSAN errors in purge_fragmented_block; confirm via kernel source or version string.

Typical attack path

1. Trigger concurrent module load or memory remapping on multiple CPUs
2. Race window in new_vmap_block() inserts uninitialised vmap_block into xarray
3. Concurrent walk via vm_unmap_aliases() dereferences uninitialised 'cpu' index
4. Resulting out-of-bounds access triggers UBSAN or kernel fault in purge_fragmented_block()

How to detect it

Search kernel logs and dmesg for UBSAN array index out of bounds errors with call traces containing purge_fragmented_block, _vm_unmap_aliases, vm_unmap_aliases, change_memory_common, set_memory_ro, or module_enable_ro; correlate with module load events.

• UBSAN: array index out of bounds
• purge_fragmented_block+0x204/0x21c
• _vm_unmap_aliases+0x170/0x378
• vm_unmap_aliases+0x1c/0x28
• change_memory_common+0x1dc/0x26c
• set_memory_ro+0x18/0x24
• module_enable_ro+0x98/0x238

What your security team should do

• Prioritise kernel updates on all multi-CPU Linux hosts within standard patch windows
• Monitor kernel logs for UBSAN array index errors referencing purge_fragmented_block
• Enable kernel hardening options such as UBSAN and page allocator sanity checks where performance permits
• Track downstream distribution backports for enterprise distributions