CVE-2024-56772
📋 TL;DR
This CVE describes a use-after-free vulnerability in the Linux kernel's KUnit testing framework. When alloc_string_stream() fails during test suite initialization, the system fails to properly nullify a freed pointer, leading to memory corruption when later accessed. This affects systems running vulnerable Linux kernel versions with KUnit enabled.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash and denial of service, potentially allowing local privilege escalation if combined with other vulnerabilities.
Likely Case
Kernel panic and system crash when loading kernel modules with KUnit tests, causing denial of service.
If Mitigated
No impact if KUnit is disabled or the system is patched.
🎯 Exploit Status
Requires ability to load kernel modules or trigger KUnit test execution. Not remotely exploitable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patches available in stable kernel trees. Check specific distribution kernels for backports.
Vendor Advisory: https://git.kernel.org/stable/c/3213b92754b94dec6836e8b4d6ec7d224a805b61
Restart Required: Yes
Instructions:
1. Update to a patched kernel version from your distribution. 2. Rebuild kernel if compiling from source with the fix. 3. Reboot system to load new kernel.
🔧 Temporary Workarounds
Disable KUnit
allDisable KUnit testing framework in kernel configuration to prevent vulnerability trigger.
Disable CONFIG_KUNIT in kernel config and rebuild kernel
🧯 If You Can't Patch
- Disable KUnit module loading via kernel module blacklisting.
- Restrict kernel module loading to trusted users only via sysctl settings.
🔍 How to Verify
Check if Vulnerable:
Check kernel version and if KUnit is enabled. Vulnerable if using affected kernel with KUnit enabled.Check Version:
uname -rVerify Fix Applied:
Verify kernel version is updated to include the fix commit 3213b92754b94dec6836e8b4d6ec7d224a805b61.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs with 'string_stream_clear' in call trace
- OOM or memory corruption errors during module loading
Network Indicators:
- None - local vulnerability only
SIEM Query:
Search for kernel panic events with 'string_stream_clear' or 'UAF' in kernel logs.