LiveActive security incident?Get immediate response
CVE Record

CVE-2024-57951: hrtimers: Handle CPU state correctly on hotplug

In the Linux kernel, the following vulnerability has been resolved: hrtimers: Handle CPU state correctly on hotplug Consider a scenario where a CPU transitions from CPUHP_ONLINE to halfway through a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back to CPUHP_ONLINE: Since hrtimers_prepare_cpu() does not run, cpu_base.hres_active remains set to 1 throughout. However, during a CPU unplug operation, the tick and the clockevents are shut down at CPUHP_AP_TICK_DYING. On return to the online state, for instance CFS incorrectly assumes that the hrtick is already active, and the chance of the clockevent device to transition to oneshot mode is also lost forever for the CPU, unless it goes back to a lower state than CPUHP_HRTIMERS_PREPARE once. This round-trip reveals another issue; cpu_base.online is not set to 1 after the transition, which appears as a WARN_ON_ONCE in enqueue_hrtimer(). Aside of that, the bulk of the per CPU state is not reset either, which means there are dangling pointers in the worst case. Address this by adding a corresponding startup() callback, which resets the stale per CPU state and sets the online flag. [ tglx: Make the new callback unconditionally available, remove the online modification in the prepare() callback and clear the remaining state in the starting callback instead of the prepare callback ]

HighCVSS 7.8Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel flaw in high-resolution timer handling during CPU hotplug state changes. A local user could potentially trigger stale per-CPU timer state, including dangling pointers, with high confidentiality, integrity, and availability impact under the published CVSS score.

Executive priority

Treat as high priority for Linux fleets with local users, shared hosting, container workloads, or operational technology appliances. There is no sourced active exploitation signal, but the impact rating and kernel memory-safety nature justify timely patch validation.

Technical view

The hrtimers CPU hotplug path failed to reset per-CPU state when a CPU moved partway offline and returned online. The kernel description cites stale hres_active and online flags, missed clockevent oneshot setup, WARN_ON_ONCE behavior, and possible dangling pointers. The fix adds startup handling to reset state.

Likely exposure

Exposure is most relevant to Linux systems running affected kernel versions or downstream distributions and products that inherited the vulnerable code. The source bundle lists Linux kernel affected version ranges and downstream Debian LTS and Siemens advisories, but product-specific Siemens details were not provided here.

Exploitation context

The CVE is not listed as CISA KEV in the source bundle, and no cited source states active exploitation. The CVSS vector indicates local access, low attack complexity, low privileges, and no user interaction, so prioritize shared systems and environments where untrusted local users or workloads exist.

Researcher notes

Focus validation on kernel version lineage and vendor backports, not only upstream version numbers. The source evidence describes a CPU hotplug state-machine bug with stale per-CPU hrtimer state and possible dangling pointers; it does not provide a public exploit path.

Mitigation direction

  • Upgrade to a vendor kernel containing the hrtimers CPU hotplug fix.
  • Check distribution advisories for the exact fixed package version.
  • Prioritize multi-user, container-host, and exposed workload hosts.
  • Track Debian LTS and vendor advisories for backported fixes.
  • For appliances, obtain Siemens or OEM-specific update guidance.

Validation and detection

  • Inventory Linux kernel versions across servers, images, and appliances.
  • Compare running kernels against vendor fixed versions and advisories.
  • Confirm patched systems have rebooted into the fixed kernel.
  • Review asset lists for Debian LTS and Siemens-managed products.
  • Monitor kernel logs for related hrtimer or CPU hotplug warnings.
Prepared
Confidence
medium
Sources
12

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-416: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-57951 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
3ADP providers
12Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-57951Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container
siemens-SADPADP container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux54d0d83a53508d687fd4a225f8aa1f18559562d0, 7f4c89400d2997939f6971c7981cc780a219e36b, 6fcbcc6c8e52650749692c7613cbe71bf601670d, 75b5016ce325f1ef9c63e5398a1064cf8a7a7354, 53f408cad05bb987af860af22f4151e5a18e6ee8, 5c0930ccaad5a74d74e8b18b648c5eb21ed2fe94, 5c0930ccaad5a74d74e8b18b648c5eb21ed2fe94, 9a2fc41acb69dd4e2a58d0c04346c3333c2341fc, 5.4.264, 5.10.204, 5.15.143, 6.1.68, 6.6.7, 4.19.302unaffected
LinuxLinux6.7, 0, 5.4.290, 5.10.234, 5.15.177, 6.1.127, 6.6.74, 6.12.11, 6.13affected
Weakness

CWE details

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-416 · source CWE mapping

Use After Free

Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.