CVE-2024-46848

What it actually does

The flaw sets an initial period of 1 for frequency estimation in perf events on Haswell, violating hardware errata HSW11 (INST_RETIRED.ALL requires >100) and HSW143 (fixed counter overcount with HT), causing NMI/IRQ loops and invalid_op warnings in intel_pmu_handle_irq.

Why it matters to the business

Performance monitoring on Haswell systems can trigger kernel warnings, interrupt storms, or instability during workloads or testing; high ecosystem prevalence in Linux deployments increases operational risk and urgency for patching despite low EPSS.

How an attack unfolds

An attacker triggers the defect by running concurrent perf or LTP cve-2015-3290-style workloads that force low-period event arming on Haswell CPUs, leading to repeated NMI handling failures; threat actors in 2024 Zero-Day Exploitation Campaigns and Linux Kernel Use of Uninitialized Resource Vulnerability have targeted similar kernel paths.

How to fix it

Update to fixed kernel commit 15210b7c8caff4929f25d049ef8404557f8ae468 or later stable releases; for listed Go components apply golang.org/x/net at 0.0.0-20211209124913-491a49abca63 and stdlib 1.16.12 where applicable.

How to confirm the fix worked

Confirm kernel version contains commit 15210b7c8caff4929f25d049ef8404557f8ae468; run LTP cve-2015-3290 concurrently with perf sampling and verify absence of intel_pmu_handle_irq warnings.

Typical attack path

1. Identify Haswell-based Linux target running vulnerable kernel
2. Execute perf event setup or LTP test that initializes frequency mode with period=1
3. Trigger multiple events expiring in same NMI or INST_RETIRED.ALL sampling
4. Observe or induce 'irq loop stuck' / 'interrupt took too long' warnings and potential system impact

How to detect it

Search kernel logs for 'perfevents: irq loop stuck' and 'WARNING: CPU.*intel_pmu_handle_irq' around NMI handlers; correlate with Haswell CPU detection and perf frequency mode activity.

What your security team should do

• Prioritize kernel upgrade on all Haswell systems within CISA-relevant timelines if applicable
• Monitor EPSS trend (stable at 0.0022) and threat actor mentions for any increase in targeting
• Audit perf event configurations for custom low-period settings as temporary mitigation