CVE-2024-47731

What it actually does

The alibaba_uncore_pmu driver in the Linux kernel fails to clear all interrupt status bits in its overflow interrupt handler, allowing repeated interrupts after a PMU counter overflow and resulting in an interrupt storm that hangs the system.

Why it matters to the business

Linux systems using the affected driver experience sudden unavailability and require reboot, disrupting workloads and operations until the kernel is updated.

How an attack unfolds

An attacker or workload triggers a PMU counter overflow interrupt on a system running the vulnerable driver; because the handler does not clear the full interrupt status, the interrupt fires continuously, overwhelming the CPU and hanging the system.

How to fix it

Update the Linux kernel to a version containing commit 24f30b34ff76648d26872dd4eaa002f074225058 or later; rebuild and deploy the updated kernel image on affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 24f30b34ff76648d26872dd4eaa002f074225058 by checking /proc/version or the kernel source; test that PMU overflow interrupts are properly cleared without recurrence.

Typical attack path

1. Identify a target Linux system using the alibaba_uncore_pmu driver
2. Trigger PMU counter overflow conditions through normal or crafted workload
3. Observe failure to clear interrupt status leading to repeated interrupts
4. Cause system-wide interrupt storm and hang

How to detect it

Review kernel logs and dmesg for repeated uncore PMU interrupt messages or entries around the alibaba_uncore_pmu driver; look for sudden spikes in interrupt counts coinciding with system hangs.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all systems exposing the alibaba_uncore_pmu driver
• Monitor for systems exhibiting high interrupt rates or unexplained hangs
• Apply the fix in test environments first to validate stability before broad rollout