CVE-2024-57849
Published: 11 January 2025
Summary
CVE-2024-57849 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 7.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2024-57849 is a use-after-free vulnerability (CWE-416) in the Linux kernel's s390/cpum_sf component, which handles CPU Measurement Facility (CPUMF) sampling on s390 architecture systems. The issue arises during CPU hotplug removal while sampling is active. When a CPU is offlined, the s390_pmu_sf_offline_cpu function deallocates sampling data buffers (SDBs) and clears the PMU_F_RESERVED bit. However, the kernel's performance subsystem subsequently invokes perf_event_exit_cpu on the removed CPU, leading to attempts to read from the already-freed SDBs via functions like cpumsf_pmu_stop and hw_perf_event_update. This affects Linux kernels supporting s390 platforms, such as those on IBM Z mainframes.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity (AC:L) and no user interaction (UI:N) in an unprivileged context (S:U). By triggering CPU hotplug removal during an active sampling event, the attacker can cause the kernel to access freed memory, potentially leading to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), as indicated by the CVSS v3.1 score of 7.8. In the worst case, this results in invalid sample data or kernel crashes due to the use-after-free condition.
Mitigation involves applying upstream kernel patches referenced in the stable commit logs, such as those at https://git.kernel.org/stable/c/06a92f810df8037ca36157282ddcbefdcaf049b8 and related commits. These patches remedy the issue by checking the PMU_F_RESERVED bit before accessing SDBs during event removal; if the bit is not set, the buffers are recognized as deallocated, preventing the use-after-free. Security practitioners should update to kernels incorporating these fixes and monitor for CPU hotplug events in s390 environments using performance monitoring tools.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53773
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: s390/cpum_sf: Handle CPU hotplug remove during sampling CPU hotplug remove handling triggers the following function call sequence: CPUHP_AP_PERF_S390_SF_ONLINE --> s390_pmu_sf_offline_cpu() ... CPUHP_AP_PERF_ONLINE --> perf_event_exit_cpu() The s390 CPUMF sampling CPU hotplug…
more
handler invokes: s390_pmu_sf_offline_cpu() +--> cpusf_pmu_setup() +--> setup_pmc_cpu() +--> deallocate_buffers() This function de-allocates all sampling data buffers (SDBs) allocated for that CPU at event initialization. It also clears the PMU_F_RESERVED bit. The CPU is gone and can not be sampled. With the event still being active on the removed CPU, the CPU event hotplug support in kernel performance subsystem triggers the following function calls on the removed CPU: perf_event_exit_cpu() +--> perf_event_exit_cpu_context() +--> __perf_event_exit_context() +--> __perf_remove_from_context() +--> event_sched_out() +--> cpumsf_pmu_del() +--> cpumsf_pmu_stop() +--> hw_perf_event_update() to stop and remove the event. During removal of the event, the sampling device driver tries to read out the remaining samples from the sample data buffers (SDBs). But they have already been freed (and may have been re-assigned). This may lead to a use after free situation in which case the samples are most likely invalid. In the best case the memory has not been reassigned and still contains valid data. Remedy this situation and check if the CPU is still in reserved state (bit PMU_F_RESERVED set). In this case the SDBs have not been released an contain valid data. This is always the case when the event is removed (and no CPU hotplug off occured). If the PMU_F_RESERVED bit is not set, the SDB buffers are gone.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Kernel UAF in performance sampling path during CPU hotplug enables local privilege escalation via memory corruption.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and correction of the use-after-free flaw in the s390/cpum_sf kernel component via application of specific patches that check the PMU_F_RESERVED bit before accessing SDBs.
Implements memory protection safeguards such as address space layout randomization and non-executable memory to mitigate the impact of use-after-free access to deallocated sampling data buffers during CPU hotplug.
Provides vulnerability scanning to identify the presence of CVE-2024-57849 in s390 kernel components, enabling proactive remediation before exploitation during CPU hotplug operations.