CVE-2024-43891 is a use-after-free vulnerability in the Linux kernel's tracing subsystem, specifically related to the handling of dynamically created event files under the eventfs interface. The vulnerability arises because the "format" files, which expose metadata about trace events to user space, do not properly honor the EVENT_FILE_FL_FREED flag that indicates when the underlying file metadata has been freed. Normally, the Linux kernel manages the lifecycle of event files by maintaining reference counts and setting this flag when the file metadata is freed, preventing further access. However, the "format" file was implemented as a shortcut by pointing its i_private field directly to the call entry rather than the file's metadata structure. This design choice meant that the "format" file did not detect when the underlying event was freed, leading to a race condition where user space processes reading the "format" file could access freed memory. This was demonstrated by running concurrent loops: one creating and freeing dynamic events, and another continuously reading the "format" file, which triggered use-after-free bugs detectable by Kernel Address Sanitizer (KASAN). The root cause is the lack of checking the EVENT_FILE_FL_FREED flag in the "format" file's code path. The patch introduces a helper function event_file_file() that ensures the event_mutex is held and returns NULL if the file metadata is freed, preventing access to invalid memory. This fix also identifies other code paths lacking this check and applies the same guard. While the vulnerability requires concurrent operations on dynamic trace events and reading their format files, it exposes a kernel memory safety issue that could potentially be exploited to cause kernel crashes or information leaks. No known exploits are reported in the wild as of now.

For European organizations, this vulnerability poses a risk primarily to systems running Linux kernels that include the vulnerable tracing subsystem code, especially those using dynamic tracing features or custom kernel tracing tools. The use-after-free condition could lead to kernel crashes (denial of service) or potentially allow attackers with local access to leak kernel memory or escalate privileges by exploiting the race condition. Organizations relying on Linux servers for critical infrastructure, cloud services, or embedded systems could face stability issues or security breaches if attackers can trigger this vulnerability. Since the attack requires concurrent access to tracing event files, it is more likely to be exploited by privileged or local users rather than remote attackers. However, in multi-tenant environments or shared hosting common in European data centers, a malicious user could leverage this flaw to disrupt services or gain unauthorized access. The vulnerability also affects kernel developers and testers using the user_events selftests, which could impact development pipelines. Overall, the impact is moderate but significant for environments where kernel tracing is enabled and accessible.

European organizations should promptly apply the official Linux kernel patches that address CVE-2024-43891 once available. Until patches are deployed, administrators should consider disabling or restricting access to the tracing subsystem, especially the eventfs interface and dynamic event creation features, to untrusted users. Limiting permissions on /sys/kernel/tracing and related directories can reduce the attack surface. Employing kernel hardening features such as Kernel Address Sanitizer (KASAN) in testing environments can help detect similar issues early. Organizations should audit their use of kernel tracing tools and ensure that only trusted personnel have access to these features. Additionally, monitoring kernel logs for unusual tracing activity or crashes may help detect exploitation attempts. For environments using custom or older kernels, backporting the patch or upgrading to a fixed kernel version is essential. Finally, incorporating this vulnerability into vulnerability management and incident response plans will ensure timely detection and remediation.