CVE-2024-57917

What it actually does

Race condition in cpumap printing allows core_cpumask to change between length calculation and formatting in kvasprintf, producing mismatched return values from vsnprintf and triggering a kernel warning during core_siblings_list_read.

Why it matters to the business

Kernel warnings and potential logging noise or minor instability during CPU hotplug events on affected Red Hat Enterprise Linux 6.6 systems; low exploitability reduces immediate operational risk but requires patching to maintain kernel reliability across compute and server deployments.

How an attack unfolds

An attacker with local access triggers rapid CPU hotplug operations while a process reads core_siblings_list via sysfs, causing the cpumask to mutate between vsnprintf length checks and buffer formatting inside bitmap_print_to_buf and kvasprintf, surfacing the warning.

How to fix it

Upgrade all listed Red Hat kernel packages to the fixed versions 0:2.6.32-504.49.1.el6 or later; apply the vendor-supplied patches that cache the cpumask in a temporary variable before calling cpumap_print functions.

How to confirm the fix worked

Confirm package versions match or exceed 0:2.6.32-504.49.1.el6 on all affected Red Hat systems; verify absence of the kvasprintf length-mismatch warning under concurrent CPU hotplug and cpumap reads.

Typical attack path

1. Obtain local access on a system running an affected kernel build
2. Rapidly toggle CPU online/offline states via hotplug interfaces
3. Simultaneously trigger reads of core_siblings_list or related cpumap sysfs files
4. Observe mismatched vsnprintf lengths inside kvasprintf leading to the warning

How to detect it

Search kernel logs and dmesg for WARNING messages originating from kvasprintf or kasprintf during cpumap or core_siblings_list operations, especially coinciding with CPU hotplug events.

What your security team should do

• Prioritize patching kernel packages on all RHEL 6.6 compute and server nodes within standard maintenance windows
• Monitor for the specific kvasprintf warning pattern in kernel logs during CPU topology changes
• Review and limit unnecessary local access that could trigger hotplug operations