CVE-2024-57360

What it actually does

The flaw permits incorrect access control in the nm --without-symbol-version function of binutils >=2.43, allowing a local process to trigger a denial-of-service condition (application crash or hang) without requiring elevated privileges beyond local execution.

Why it matters to the business

Systems using the listed kpatch live-patching packages on Red Hat Enterprise Linux 7.6 may experience unexpected interruptions when nm processes are invoked locally, potentially affecting kernel analysis or patching workflows, although low EPSS and absence from KEV indicate limited immediate operational risk.

How an attack unfolds

An attacker with local system access supplies a crafted binary to the nm utility invoked with the --without-symbol-version flag, bypassing intended access controls and causing the process to terminate abnormally.

How to fix it

Upgrade each affected kpatch package to its corresponding fixed version (for example kpatch-patch-3_10_0-957_61_1 to 0:1-5.el7, kpatch-patch-3_10_0-957_70_1 to 0:1-4.el7, kpatch-patch-3_10_0-957_72_1 to 0:1-2.el7, and similarly for the remaining listed packages).

How to confirm the fix worked

Confirm installed package versions match or exceed the listed fixed releases, then execute nm --without-symbol-version against representative binaries to verify normal operation and absence of crashes.

Typical attack path

1. Gain local interactive or script-based access to an affected host
2. Locate or craft a binary input that exercises the symbol-version code path
3. Invoke nm --without-symbol-version against the input
4. Observe denial-of-service outcome

How to detect it

Review system and application logs for repeated nm process crashes or segmentation faults occurring shortly after invocation with symbol-related flags; correlate with local user activity on hosts running the listed kpatch packages.

What your security team should do

• Apply the exact package updates listed for each kpatch variant at the earliest maintenance window
• Restrict local execution of nm to trusted users or containers where feasible
• Include binutils usage in routine crash-log monitoring