CVE-2024-56706: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-56706 is a vulnerability in the Linux kernel's s390/cpum_sf component, discovered and disclosed on December 28, 2024. The issue affects the memory allocation of Sample Data Blocks (SDBs) in the Performance Monitoring Unit (PMU) hardware. The vulnerability stems from improper mutex protection during the PMU hardware reservation process (Kernel Git).

The vulnerability occurs during the PMU hardware reservation process where memory allocation for PMUs is performed outside mutex protection. Specifically, after the initial PMU hardware reservation (protected by mutex_lock() and mutex_unlock()), the allocate_buffers() and alloc_sampling_buffer() functions are called without proper mutex protection. This implementation flaw allows concurrent invocations of perf_event_init() to run in parallel, potentially leading to multiple allocations of Sample Data Blocks (SDBs) for the same PMU (Red Hat). The vulnerability has been assigned a CVSS v3.1 score of 5.5 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

The vulnerability can result in multiple allocations of Sample Data Blocks (SDBs) for the same Performance Monitoring Unit (PMU), potentially leading to resource management issues and system instability (Kernel Git).

The vulnerability has been patched by implementing proper mutex protection around the memory allocation of SDBs. The fix ensures that the allocation of buffers is protected by the same mutex that guards the PMU hardware reservation (Kernel Git).