Linux · Linux Kernel · CVE-2024-56675
**Name of the Vulnerable Software and Affected Versions**
Linux kernel versions prior to 6.6.74
**Description**
The issue is related to a use-after-free (UAF) vulnerability in the Linux kernel's BPF uprobe attachments. Uprobes use `bpf prog run array uprobe()` under tasks-trace-RCU protection, but it is possible to attach a non-sleepable BPF program to a uprobe. Non-sleepable BPF programs are freed via normal RCU, which can lead to UAF of the `bpf prog` because a normal RCU grace period does not imply a tasks-trace-RCU grace period. The vulnerability can be exploited to impact the confidentiality, integrity, and availability of protected information.
**Recommendations**
To resolve the issue, update the Linux kernel to version 6.6.74 or later. As a temporary workaround, consider restricting the use of non-sleepable BPF programs with uprobe attachments until a patch is available. Avoid using the `bpf prog run array uprobe()` function under tasks-trace-RCU protection with non-sleepable BPF programs.