CVE-2024-57951: hrtimers: Handle CPU state correctly on hotplug
In the Linux kernel, the following vulnerability has been resolved:
hrtimers: Handle CPU state correctly on hotplug
Consider a scenario where a CPU transitions from CPUHP_ONLINE to halfway
through a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back to
CPUHP_ONLINE:
Since hrtimers_prepare_cpu() does not run, cpu_base.hres_active remains set
to 1 throughout. However, during a CPU unplug operation, the tick and the
clockevents are shut down at CPUHP_AP_TICK_DYING. On return to the online
state, for instance CFS incorrectly assumes that the hrtick is already
active, and the chance of the clockevent device to transition to oneshot
mode is also lost forever for the CPU, unless it goes back to a lower state
than CPUHP_HRTIMERS_PREPARE once.
This round-trip reveals another issue; cpu_base.online is not set to 1
after the transition, which appears as a WARN_ON_ONCE in enqueue_hrtimer().
Aside of that, the bulk of the per CPU state is not reset either, which
means there are dangling pointers in the worst case.
Address this by adding a corresponding startup() callback, which resets the
stale per CPU state and sets the online flag.
[ tglx: Make the new callback unconditionally available, remove the online
modification in the prepare() callback and clear the remaining
state in the starting callback instead of the prepare callback ]
Security readout for executives and security teams
Plain-English summary
This is a Linux kernel flaw in high-resolution timer handling during CPU hotplug state changes. A local user could potentially trigger stale per-CPU timer state, including dangling pointers, with high confidentiality, integrity, and availability impact under the published CVSS score.
Executive priority
Treat as high priority for Linux fleets with local users, shared hosting, container workloads, or operational technology appliances. There is no sourced active exploitation signal, but the impact rating and kernel memory-safety nature justify timely patch validation.
Technical view
The hrtimers CPU hotplug path failed to reset per-CPU state when a CPU moved partway offline and returned online. The kernel description cites stale hres_active and online flags, missed clockevent oneshot setup, WARN_ON_ONCE behavior, and possible dangling pointers. The fix adds startup handling to reset state.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions or downstream distributions and products that inherited the vulnerable code. The source bundle lists Linux kernel affected version ranges and downstream Debian LTS and Siemens advisories, but product-specific Siemens details were not provided here.
Exploitation context
The CVE is not listed as CISA KEV in the source bundle, and no cited source states active exploitation. The CVSS vector indicates local access, low attack complexity, low privileges, and no user interaction, so prioritize shared systems and environments where untrusted local users or workloads exist.
Researcher notes
Focus validation on kernel version lineage and vendor backports, not only upstream version numbers. The source evidence describes a CPU hotplug state-machine bug with stale per-CPU hrtimer state and possible dangling pointers; it does not provide a public exploit path.
Mitigation direction
Upgrade to a vendor kernel containing the hrtimers CPU hotplug fix.
Check distribution advisories for the exact fixed package version.
Prioritize multi-user, container-host, and exposed workload hosts.
Track Debian LTS and vendor advisories for backported fixes.
For appliances, obtain Siemens or OEM-specific update guidance.
Validation and detection
Inventory Linux kernel versions across servers, images, and appliances.
Compare running kernels against vendor fixed versions and advisories.
Confirm patched systems have rebooted into the fixed kernel.
Review asset lists for Debian LTS and Siemens-managed products.
Monitor kernel logs for related hrtimer or CPU hotplug warnings.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cwe · low confidence lookup
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
3ADP providers
12Source links
SSVC decision data
CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE-416 · source CWE mapping
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.