CVE-2024-56761

What it actually does

Failure to clear the WAIT_FOR_ENDBRANCH (WFE) state after a missing-ENDBRANCH control protection fault (#CP) on FRED-enabled x86 systems leaves the indirect branch tracker asserted, causing the CPU to repeatedly fault on the resuming instruction and enter a dead loop in ibt_clear_fred_wfe and related !ibt_fatal paths.

Why it matters to the business

Kernel-level hangs and denial of service on systems using modern x86 control-flow integrity features; high ecosystem prevalence of the Linux kernel amplifies operational disruption risk even though exploitation maturity remains low.

How an attack unfolds

An attacker or test harness triggers a deliberate missing-ENDBRANCH #CP; because FRED preserves WFE across the fault, the subsequent IRET-style return immediately re-enters the faulting instruction with WFE still set, locking the CPU. The provided fix clears WFE in the fault handler so execution can continue safely.

How to fix it

Update the Linux kernel to a version containing the fix that calls ibt_clear_fred_wfe() in the #CP handler; for the listed chromium-browser packages on Ubuntu 14.04 LTS apply 53.0.2785.143-0ubuntu0.14.04.1.1142 or newer.

How to confirm the fix worked

Boot a FRED+IBT enabled kernel, run the kernel IBT selftest that deliberately triggers #CPs, and confirm the test completes without dead-looping; inspect dmesg for absence of repeated #CP messages.

Typical attack path

1. Trigger a #CP fault via an indirect branch without a valid ENDBRANCH
2. FRED entry saves WFE state instead of clearing it
3. Handler allows return to the faulting instruction without clearing WFE
4. CPU immediately raises another #CP, entering an unrecoverable loop

How to detect it

Search kernel logs for repeated control-protection fault messages immediately followed by CPU soft lockup or NMI watchdog traces on FRED-enabled systems; examine any crash dumps for WFE state in the extended CS area.

What your security team should do

• Prioritize kernel upgrades on all FRED-capable x86 systems within normal patch windows
• Enable kernel IBT selftests in CI to verify WFE handling
• Monitor EPSS and KEV status for any future increase in exploit maturity