Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-56761— x86/fred: Clear WFE in missing-ENDBRANCH #CPs

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在x86/fred模块中，当触发“kernel IBT no ENDBR”自测试时，#CP中断后，中断上下文的WFE状态未被清除，导致CPU在恢复执行时再次引发missing-ENDBRANCH #CP，进入死循环，影响系统的正常运行和安全性。

AI Predicted 5.3 Difficulty: Theoretical EPSS 0.22% · P12

Possible ATT&CK Techniques 1 AI

T1205 · Traffic Signaling

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux a5f6c2ace9974adf92ce65dacca8126d90adabfe< 151447859d6fb0dcce8259f0971c6e94fb801661 affected
a5f6c2ace9974adf92ce65dacca8126d90adabfe< b939f108e86b76119428a6fa4e92491e09ac7867 affected
a5f6c2ace9974adf92ce65dacca8126d90adabfe< dc81e556f2a017d681251ace21bf06c126d5a192 affected
6.6 affected
< 6.6 unaffected
6.6.70≤ 6.6.* unaffected
6.12.8≤ 6.12.* unaffected
6.13≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-56761

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
x86/fred: Clear WFE in missing-ENDBRANCH #CPs
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: x86/fred: Clear WFE in missing-ENDBRANCH #CPs An indirect branch instruction sets the CPU indirect branch tracker (IBT) into WAIT_FOR_ENDBRANCH (WFE) state and WFE stays asserted across the instruction boundary. When the decoder finds an inappropriate instruction while WFE is set ENDBR, the CPU raises a #CP fault. For the "kernel IBT no ENDBR" selftest where #CPs are deliberately triggered, the WFE state of the interrupted context needs to be cleared to let execution continue. Otherwise when the CPU resumes from the instruction that just caused the previous #CP, another missing-ENDBRANCH #CP is raised and the CPU enters a dead loop. This is not a problem with IDT because it doesn't preserve WFE and IRET doesn't set WFE. But FRED provides space on the entry stack (in an expanded CS area) to save and restore the WFE state, thus the WFE state is no longer clobbered, so software must clear it. Clear WFE to avoid dead looping in ibt_clear_fred_wfe() and the !ibt_fatal code path when execution is allowed to continue. Clobbering WFE in any other circumstance is a security-relevant bug. [ dhansen: changelog rewording ]
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在x86/fred模块中，当触发“kernel IBT no ENDBR”自测试时，#CP中断后，中断上下文的WFE状态未被清除，导致CPU在恢复执行时再次引发missing-ENDBRANCH #CP，进入死循环，影响系统的正常运行和安全性。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux a5f6c2ace9974adf92ce65dacca8126d90adabfe ~ 151447859d6fb0dcce8259f0971c6e94fb801661 -
Linux Linux 6.6 -

II. Public POCs for CVE-2024-56761

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-56761

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-56761 (3)

Same Patch Batch · Linux · 2025-01-06 · 12 CVEs total

CVE-2024-56757 7.8 HIGH Bluetooth: btusb: mediatek: add intf release flow when usb disconnect
CVE-2024-56759 7.8 HIGH btrfs: fix use-after-free when COWing tree bock and tracing is enabled
CVE-2024-56764 7.8 HIGH ublk: detach gendisk from ublk device if add_disk() fails
CVE-2024-56765 7.8 HIGH powerpc/pseries/vas: Add close() callback in vas_vm_ops struct
CVE-2024-56758 btrfs: check folio mapping after unlock in relocate_one_folio()
CVE-2024-56760 PCI/MSI: Handle lack of irqdomain gracefully
CVE-2024-56763 tracing: Prevent bad count for tracing_cpumask_write
CVE-2024-56767 dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset
CVE-2024-56766 mtd: rawnand: fix double free in atmel_pmecc_create_user()
CVE-2024-56768 bpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMP
CVE-2024-56769 media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-56761

No comments yet

Leave a comment