CVE-2024-57934

What it actually does

Race condition in __ftrace_return_to_handler() allows compiler reload of fgraph_array[] after stub check, permitting use of a fgraph_stub with null func_hash and resulting NULL pointer dereference.

Why it matters to the business

Potential kernel crashes or denial of service on systems using ftrace function graph tracing; low exploitation likelihood reduces urgency but kernel-level impact remains high for affected Linux deployments.

How an attack unfolds

An attacker with ability to trigger ftrace updates concurrently with return-to-handler paths races the array access so that a stub element is dereferenced after the check passes, crashing the kernel.

How to fix it

Apply kernel patches adding READ_ONCE() protection (commit b68b2a3fbacc7be720ef589d489bcacdd05c6d38 or equivalent stable backports). Rebuild and reboot with fixed kernel; for Red Hat systems update flash-plugin to 11.2.202.626-1.el5_11 or 11.2.202.626-1.el6_8 where applicable.

How to confirm the fix worked

Confirm presence of READ_ONCE() in __ftrace_return_to_handler() loop accessing fgraph_array[]; verify kernel version contains the fix commit and test ftrace enable/disable under load for absence of NULL dereference.

Typical attack path

1. Obtain local code execution or trigger ftrace instrumentation changes
2. Time concurrent modification of fgraph_array[] with execution of __ftrace_return_to_handler()
3. Force reload of array element after stub validation to dereference null func_hash
4. Trigger kernel panic or denial of service

How to detect it

Review kernel logs for NULL pointer dereference oops in __ftrace_return_to_handler or fgraph code paths; correlate with ftrace enable/disable events or module loads around crash time.

What your security team should do

• Prioritize patching production kernels using ftrace within maintenance windows
• Monitor upstream stable branches for backports if running older releases
• Limit ftrace use to trusted administrative contexts until updated