CVE-2024-56665

What it actually does

Race condition allowing NULL prog_array dereference in perf_event_detach_bpf_prog during detach of inherited tracepoint perf events after fork/exit sequences.

Why it matters to the business

Kernel crashes on Linux systems using perf tracing with inherited events and attached BPF programs, leading to denial of service and operational disruption; high prevalence in kernel-dependent environments increases exposure risk.

How an attack unfolds

An attacker creates a tracepoint perf event with inherit=1, attaches a BPF program, triggers process fork to create a child event sharing the prog_array, then exits both processes so the second detach encounters a NULL prog_array.

How to fix it

Upgrade the Linux kernel to the fixed commit df0cc57e057f18e44dac8e6c18aba47ab53202f9 or later equivalent patch that adds a validity check before prog_array access in perf_event_detach_bpf_prog.

How to confirm the fix worked

Verify the kernel source contains the check for non-NULL tp_event->prog_array in perf_event_detach_bpf_prog; test with reproducer scenarios involving inherited tracepoint events and fork/exit.

Typical attack path

1. Create tracepoint perf event with attr.inherit=1 and attach BPF program
2. Trigger fork in the attached process to create inherited child event
3. Exit both parent and child processes to invoke detach on shared prog_array
4. Trigger second perf_event_detach_bpf_prog call after first has freed the array

How to detect it

Inspect kernel logs for oops or panic messages referencing perf_event_detach_bpf_prog or NULL pointer dereference in BPF/perf paths; correlate with process fork/exit events under tracing.

What your security team should do

• Apply the kernel patch immediately on all affected systems
• Monitor for kernel oops or crashes involving perf and BPF during tracing workloads
• Restrict unprivileged perf_event_open usage until patched