CVE-2024-36963

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-36963", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-30T15:25:07.081Z", "datePublished": "2024-06-03T07:50:01.125Z", "dateUpdated": "2026-08-05T11:32:17.919Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:32:17.919Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracefs: Reset permissions on remount if permissions are options\n\nThere's an inconsistency with the way permissions are handled in tracefs.\nBecause the permissions are generated when accessed, they default to the\nroot inode's permission if they were never set by the user. If the user\nsets the permissions, then a flag is set and the permissions are saved via\nthe inode (for tracefs files) or an internal attribute field (for\neventfs).\n\nBut if a remount happens that specify the permissions, all the files that\nwere not changed by the user gets updated, but the ones that were are not.\nIf the user were to remount the file system with a given permission, then\nall files and directories within that file system should be updated.\n\nThis can cause security issues if a file's permission was updated but the\nadmin forgot about it. They could incorrectly think that remounting with\npermissions set would update all files, but miss some.\n\nFor example:\n\n # cd /sys/kernel/tracing\n # chgrp 1002 current_tracer\n # ls -l\n[..]\n -rw-r----- 1 root root 0 May 1 21:25 buffer_size_kb\n -rw-r----- 1 root root 0 May 1 21:25 buffer_subbuf_size_kb\n -r--r----- 1 root root 0 May 1 21:25 buffer_total_size_kb\n -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer\n -rw-r----- 1 root root 0 May 1 21:25 dynamic_events\n -r--r----- 1 root root 0 May 1 21:25 dyn_ftrace_total_info\n -r--r----- 1 root root 0 May 1 21:25 enabled_functions\n\nWhere current_tracer now has group \"lkp\".\n\n # mount -o remount,gid=1001 .\n # ls -l\n -rw-r----- 1 root tracing 0 May 1 21:25 buffer_size_kb\n -rw-r----- 1 root tracing 0 May 1 21:25 buffer_subbuf_size_kb\n -r--r----- 1 root tracing 0 May 1 21:25 buffer_total_size_kb\n -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer\n -rw-r----- 1 root tracing 0 May 1 21:25 dynamic_events\n -r--r----- 1 root tracing 0 May 1 21:25 dyn_ftrace_total_info\n -r--r----- 1 root tracing 0 May 1 21:25 enabled_functions\n\nEverything changed but the \"current_tracer\".\n\nAdd a new link list that keeps track of all the tracefs_inodes which has\nthe permission flags that tell if the file/dir should use the root inode's\npermission or not. Then on remount, clear all the flags so that the\ndefault behavior of using the root inode's permission is done for all\nfiles and directories."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is reached through ordinary filesystem operations on tracefs (open/read/write/stat, chown) at /sys/kernel/tracing, which requires a local account on the system. There is no network-reachable path to tracefs permission handling.\nAC:L - The stale-permission condition is deterministic \u2014 no race, no memory-layout or timing dependency \u2014 and the attacker can set the pinning flag themselves, since fs/attr.c:chown_ok() allows an owner's no-op self-chown and chgrp_ok() allows an owner chgrp to their own group, so a granted user can pin every tracefs file at will. Remounting with uid=/gid= is the documented, routinely used way to manage tracefs ownership, so the exploited state arises in normal administration.\nPR:L - The attacker needs only an unprivileged local account that holds (or previously held) tracefs access via the uid=/gid= mount option or the tracing group; no CAP_SYS_ADMIN, CAP_CHOWN or root is required, because setting the pinning flag is permitted to the file's own owner. Root privileges are never needed on the attacker's side.\nUI:N - Once the file system is in the vulnerable state, the attacker simply exercises retained read/write access to tracefs with no action required from any other user. The administrator's remount is a routine configuration operation that establishes the state, not an attacker-induced victim interaction at exploitation time.\nS:U - The unauthorized access and its consequences stay within the kernel/OS security authority managing tracefs; no VM, IOMMU, or container-host boundary is crossed.\nC:H - Retained access to tracefs yields the ring buffer (`trace`, `trace_pipe`, `trace_pipe_raw`) containing kernel addresses and other processes' syscall data, and writable `kprobe_events`/`dynamic_events` gives probe fetch arguments that dereference and dump arbitrary kernel memory \u2014 an effective arbitrary kernel-read primitive that also defeats KASLR.\nI:H - Group/owner write access is retained on 0640 control files, letting the attacker install kprobes/uprobes, switch tracers, rewrite `set_ftrace_filter` and event filters/triggers, and clear or inject ring-buffer records \u2014 modifying kernel-wide tracing behavior and destroying trace/audit evidence that the administrator believed was locked down.\nA:H - Retained write access to `buffer_size_kb`/per-CPU `buffer_size_kb` permits allocating enormous per-CPU ring buffers leading to memory exhaustion and OOM kills, and enabling global function/function_graph tracing degrades the entire system, so a complete denial of service is achievable."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/tracefs/event_inode.c", "fs/tracefs/inode.c", "fs/tracefs/internal.h"], "versions": [{"version": "628adb842bd5e1c2c598534a7a022b8235289de6", "lessThan": "5f91fc82794d4a6e41cdcd02d00baa377d94ca78", "status": "affected", "versionType": "git"}, {"version": "8186fff7ab649085e2c60d032d9a20a85af1d87c", "lessThan": "414fb08628143203d29ccd0264b5a83fb9523c03", "status": "affected", "versionType": "git"}, {"version": "8186fff7ab649085e2c60d032d9a20a85af1d87c", "lessThan": "baa23a8d4360d981a49913841a726edede5cdd54", "status": "affected", "versionType": "git"}, {"version": "9c2ac5e0ea7899411fd900d4681890722a020735", "status": "affected", "versionType": "git"}, {"version": "6.6.18", "lessThan": "6.6.31", "status": "affected", "versionType": "semver"}, {"version": "6.7.4", "lessThan": "6.8", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/tracefs/event_inode.c", "fs/tracefs/inode.c", "fs/tracefs/internal.h"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.31", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.10", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.18", "versionEndExcluding": "6.6.31"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.8.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7.4"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5f91fc82794d4a6e41cdcd02d00baa377d94ca78"}, {"url": "https://git.kernel.org/stable/c/414fb08628143203d29ccd0264b5a83fb9523c03"}, {"url": "https://git.kernel.org/stable/c/baa23a8d4360d981a49913841a726edede5cdd54"}], "title": "tracefs: Reset permissions on remount if permissions are options", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-863", "lang": "en", "description": "CWE-863 Incorrect Authorization"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-05-20T14:06:38.590905Z", "id": "CVE-2024-36963", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-20T14:07:59.778Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.371Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/5f91fc82794d4a6e41cdcd02d00baa377d94ca78", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/414fb08628143203d29ccd0264b5a83fb9523c03", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/baa23a8d4360d981a49913841a726edede5cdd54", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/5f91fc82794d4a6e41cdcd02d00baa377d94ca78", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/414fb08628143203d29ccd0264b5a83fb9523c03", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/baa23a8d4360d981a49913841a726edede5cdd54", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.371Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-36963", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-20T14:06:38.590905Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T15:38:05.479Z"}}], "cna": {"title": "tracefs: Reset permissions on remount if permissions are options", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "628adb842bd5e1c2c598534a7a022b8235289de6", "lessThan": "5f91fc82794d4a6e41cdcd02d00baa377d94ca78", "versionType": "git"}, {"status": "affected", "version": "8186fff7ab649085e2c60d032d9a20a85af1d87c", "lessThan": "414fb08628143203d29ccd0264b5a83fb9523c03", "versionType": "git"}, {"status": "affected", "version": "8186fff7ab649085e2c60d032d9a20a85af1d87c", "lessThan": "baa23a8d4360d981a49913841a726edede5cdd54", "versionType": "git"}, {"status": "affected", "version": "9c2ac5e0ea7899411fd900d4681890722a020735", "versionType": "git"}, {"status": "affected", "version": "6.6.18", "lessThan": "6.6.31", "versionType": "semver"}, {"status": "affected", "version": "6.7.4", "lessThan": "6.8", "versionType": "semver"}], "programFiles": ["fs/tracefs/event_inode.c", "fs/tracefs/inode.c", "fs/tracefs/internal.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"status": "unaffected", "version": "0", "lessThan": "6.8", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.31", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.10", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/tracefs/event_inode.c", "fs/tracefs/inode.c", "fs/tracefs/internal.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/5f91fc82794d4a6e41cdcd02d00baa377d94ca78"}, {"url": "https://git.kernel.org/stable/c/414fb08628143203d29ccd0264b5a83fb9523c03"}, {"url": "https://git.kernel.org/stable/c/baa23a8d4360d981a49913841a726edede5cdd54"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracefs: Reset permissions on remount if permissions are options\n\nThere's an inconsistency with the way permissions are handled in tracefs.\nBecause the permissions are generated when accessed, they default to the\nroot inode's permission if they were never set by the user. If the user\nsets the permissions, then a flag is set and the permissions are saved via\nthe inode (for tracefs files) or an internal attribute field (for\neventfs).\n\nBut if a remount happens that specify the permissions, all the files that\nwere not changed by the user gets updated, but the ones that were are not.\nIf the user were to remount the file system with a given permission, then\nall files and directories within that file system should be updated.\n\nThis can cause security issues if a file's permission was updated but the\nadmin forgot about it. They could incorrectly think that remounting with\npermissions set would update all files, but miss some.\n\nFor example:\n\n # cd /sys/kernel/tracing\n # chgrp 1002 current_tracer\n # ls -l\n[..]\n -rw-r----- 1 root root 0 May 1 21:25 buffer_size_kb\n -rw-r----- 1 root root 0 May 1 21:25 buffer_subbuf_size_kb\n -r--r----- 1 root root 0 May 1 21:25 buffer_total_size_kb\n -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer\n -rw-r----- 1 root root 0 May 1 21:25 dynamic_events\n -r--r----- 1 root root 0 May 1 21:25 dyn_ftrace_total_info\n -r--r----- 1 root root 0 May 1 21:25 enabled_functions\n\nWhere current_tracer now has group \"lkp\".\n\n # mount -o remount,gid=1001 .\n # ls -l\n -rw-r----- 1 root tracing 0 May 1 21:25 buffer_size_kb\n -rw-r----- 1 root tracing 0 May 1 21:25 buffer_subbuf_size_kb\n -r--r----- 1 root tracing 0 May 1 21:25 buffer_total_size_kb\n -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer\n -rw-r----- 1 root tracing 0 May 1 21:25 dynamic_events\n -r--r----- 1 root tracing 0 May 1 21:25 dyn_ftrace_total_info\n -r--r----- 1 root tracing 0 May 1 21:25 enabled_functions\n\nEverything changed but the \"current_tracer\".\n\nAdd a new link list that keeps track of all the tracefs_inodes which has\nthe permission flags that tell if the file/dir should use the root inode's\npermission or not. Then on remount, clear all the flags so that the\ndefault behavior of using the root inode's permission is done for all\nfiles and directories."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.31", "versionStartIncluding": "6.6.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.10", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.7.4"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T15:48:01.182Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36963", "state": "PUBLISHED", "dateUpdated": "2026-05-23T15:48:01.182Z", "dateReserved": "2024-05-30T15:25:07.081Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-03T07:50:01.125Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/tracefs/event_inode.c", "fs/tracefs/inode.c", "fs/tracefs/internal.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5f91fc82794d4a6e41cdcd02d00baa377d94ca78", "status": "affected", "version": "628adb842bd5e1c2c598534a7a022b8235289de6", "versionType": "git"}, {"lessThan": "414fb08628143203d29ccd0264b5a83fb9523c03", "status": "affected", "version": "8186fff7ab649085e2c60d032d9a20a85af1d87c", "versionType": "git"}, {"lessThan": "baa23a8d4360d981a49913841a726edede5cdd54", "status": "affected", "version": "8186fff7ab649085e2c60d032d9a20a85af1d87c", "versionType": "git"}, {"status": "affected", "version": "9c2ac5e0ea7899411fd900d4681890722a020735", "versionType": "git"}, {"lessThan": "6.6.31", "status": "affected", "version": "6.6.18", "versionType": "semver"}, {"lessThan": "6.8", "status": "affected", "version": "6.7.4", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/tracefs/event_inode.c", "fs/tracefs/inode.c", "fs/tracefs/internal.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.31", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "502244AD-BE94-4F0D-9162-02C04B7ED925", "versionEndExcluding": "6.6.31", "versionStartIncluding": "6.6.18", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F7413227-3EF9-4BDD-B655-0727F81CFEB2", "versionEndExcluding": "6.8.10", "versionStartIncluding": "6.7.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*", "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*", "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*", "matchCriteriaId": "A06B2CCF-3F43-4FA9-8773-C83C3F5764B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*", "matchCriteriaId": "F850DCEC-E08B-4317-A33B-D2DCF39F601B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc6:*:*:*:*:*:*", "matchCriteriaId": "91326417-E981-482E-A5A3-28BC1327521B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracefs: Reset permissions on remount if permissions are options\n\nThere's an inconsistency with the way permissions are handled in tracefs.\nBecause the permissions are generated when accessed, they default to the\nroot inode's permission if they were never set by the user. If the user\nsets the permissions, then a flag is set and the permissions are saved via\nthe inode (for tracefs files) or an internal attribute field (for\neventfs).\n\nBut if a remount happens that specify the permissions, all the files that\nwere not changed by the user gets updated, but the ones that were are not.\nIf the user were to remount the file system with a given permission, then\nall files and directories within that file system should be updated.\n\nThis can cause security issues if a file's permission was updated but the\nadmin forgot about it. They could incorrectly think that remounting with\npermissions set would update all files, but miss some.\n\nFor example:\n\n # cd /sys/kernel/tracing\n # chgrp 1002 current_tracer\n # ls -l\n[..]\n -rw-r----- 1 root root 0 May 1 21:25 buffer_size_kb\n -rw-r----- 1 root root 0 May 1 21:25 buffer_subbuf_size_kb\n -r--r----- 1 root root 0 May 1 21:25 buffer_total_size_kb\n -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer\n -rw-r----- 1 root root 0 May 1 21:25 dynamic_events\n -r--r----- 1 root root 0 May 1 21:25 dyn_ftrace_total_info\n -r--r----- 1 root root 0 May 1 21:25 enabled_functions\n\nWhere current_tracer now has group \"lkp\".\n\n # mount -o remount,gid=1001 .\n # ls -l\n -rw-r----- 1 root tracing 0 May 1 21:25 buffer_size_kb\n -rw-r----- 1 root tracing 0 May 1 21:25 buffer_subbuf_size_kb\n -r--r----- 1 root tracing 0 May 1 21:25 buffer_total_size_kb\n -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer\n -rw-r----- 1 root tracing 0 May 1 21:25 dynamic_events\n -r--r----- 1 root tracing 0 May 1 21:25 dyn_ftrace_total_info\n -r--r----- 1 root tracing 0 May 1 21:25 enabled_functions\n\nEverything changed but the \"current_tracer\".\n\nAdd a new link list that keeps track of all the tracefs_inodes which has\nthe permission flags that tell if the file/dir should use the root inode's\npermission or not. Then on remount, clear all the flags so that the\ndefault behavior of using the root inode's permission is done for all\nfiles and directories."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracefs: restablece los permisos al volver a montar si los permisos son opciones. Hay una inconsistencia en la forma en que se manejan los permisos en tracefs. Debido a que los permisos se generan cuando se accede a ellos, de forma predeterminada son los permisos del inodo ra\u00edz si el usuario nunca los configur\u00f3. Si el usuario establece los permisos, entonces se establece una bandera y los permisos se guardan a trav\u00e9s del inodo (para archivos tracefs) o un campo de atributo interno (para eventfs). Pero si ocurre un reinicio que especifica los permisos, todos los archivos que no fueron modificados por el usuario se actualizan, pero los que s\u00ed no lo fueron. Si el usuario volviera a montar el sistema de archivos con un permiso determinado, entonces todos los archivos y directorios dentro de ese sistema de archivos deber\u00edan actualizarse. Esto puede causar problemas de seguridad si se actualiz\u00f3 el permiso de un archivo pero el administrador lo olvid\u00f3. Podr\u00edan pensar incorrectamente que volver a montar con los permisos establecidos actualizar\u00eda todos los archivos, pero perder\u00eda algunos. Por ejemplo: # cd /sys/kernel/tracing # chgrp 1002 current_tracer # ls -l [..] -rw-r----- 1 ra\u00edz ra\u00edz 0 1 de mayo 21:25 buffer_size_kb -rw-r---- - 1 ra\u00edz ra\u00edz 0 1 de mayo 21:25 buffer_subbuf_size_kb -r--r----- 1 ra\u00edz ra\u00edz 0 1 de mayo 21:25 buffer_total_size_kb -rw-r----- 1 ra\u00edz lkp 0 1 de mayo 21:25 current_tracer -rw-r----- 1 ra\u00edz ra\u00edz 0 1 de mayo 21:25 Dynamic_events -r--r----- 1 ra\u00edz ra\u00edz 0 1 de mayo 21:25 dyn_ftrace_total_info -r--r----- 1 root root 0 1 de mayo 21:25 enable_functions Donde current_tracer ahora tiene el grupo \"lkp\". # montar -o remontar, gid=1001. # ls -l -rw-r----- 1 rastreo de ra\u00edz 0 1 de mayo 21:25 buffer_size_kb -rw-r----- 1 rastreo de ra\u00edz 0 1 de mayo 21:25 buffer_subbuf_size_kb -r--r--- -- 1 rastreo de ra\u00edz 0 1 de mayo 21:25 buffer_total_size_kb -rw-r----- 1 rastreo de ra\u00edz 0 1 de mayo 21:25 current_tracer -rw-r----- 1 rastreo de ra\u00edz 0 1 de mayo 21:25 Dynamic_events -r--r----- 1 rastreo de ra\u00edz 0 1 de mayo 21:25 dyn_ftrace_total_info -r--r----- 1 rastreo de ra\u00edz 0 1 de mayo 21:25 enable_functions Todo cambi\u00f3 excepto el \"current_tracer\". Agregue una nueva lista de enlaces que realice un seguimiento de todos los tracefs_inodes que tienen indicadores de permiso que indican si el archivo/directorio debe usar el permiso del inodo ra\u00edz o no. Luego, al volver a montar, borre todas las banderas para que el comportamiento predeterminado de usar el permiso del inodo ra\u00edz se realice para todos los archivos y directorios."}], "id": "CVE-2024-36963", "lastModified": "2026-06-17T07:37:27.933", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-36963", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-05-20T14:06:38.590905Z", "version": "2.0.3"}}]}, "published": "2024-06-03T08:15:09.820", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/414fb08628143203d29ccd0264b5a83fb9523c03"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5f91fc82794d4a6e41cdcd02d00baa377d94ca78"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/baa23a8d4360d981a49913841a726edede5cdd54"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/414fb08628143203d29ccd0264b5a83fb9523c03"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5f91fc82794d4a6e41cdcd02d00baa377d94ca78"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/baa23a8d4360d981a49913841a726edede5cdd54"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: tracefs: Reset permissions on remount if permissions are options", "id": "2290405", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2290405"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntracefs: Reset permissions on remount if permissions are options\nThere's an inconsistency with the way permissions are handled in tracefs.\nBecause the permissions are generated when accessed, they default to the\nroot inode's permission if they were never set by the user. If the user\nsets the permissions, then a flag is set and the permissions are saved via\nthe inode (for tracefs files) or an internal attribute field (for\neventfs).\nBut if a remount happens that specify the permissions, all the files that\nwere not changed by the user gets updated, but the ones that were are not.\nIf the user were to remount the file system with a given permission, then\nall files and directories within that file system should be updated.\nThis can cause security issues if a file's permission was updated but the\nadmin forgot about it. They could incorrectly think that remounting with\npermissions set would update all files, but miss some.\nFor example:\n# cd /sys/kernel/tracing\n# chgrp 1002 current_tracer\n# ls -l\n[..]\n-rw-r----- 1 root root 0 May 1 21:25 buffer_size_kb\n-rw-r----- 1 root root 0 May 1 21:25 buffer_subbuf_size_kb\n-r--r----- 1 root root 0 May 1 21:25 buffer_total_size_kb\n-rw-r----- 1 root lkp 0 May 1 21:25 current_tracer\n-rw-r----- 1 root root 0 May 1 21:25 dynamic_events\n-r--r----- 1 root root 0 May 1 21:25 dyn_ftrace_total_info\n-r--r----- 1 root root 0 May 1 21:25 enabled_functions\nWhere current_tracer now has group \"lkp\".\n# mount -o remount,gid=1001 .\n# ls -l\n-rw-r----- 1 root tracing 0 May 1 21:25 buffer_size_kb\n-rw-r----- 1 root tracing 0 May 1 21:25 buffer_subbuf_size_kb\n-r--r----- 1 root tracing 0 May 1 21:25 buffer_total_size_kb\n-rw-r----- 1 root lkp 0 May 1 21:25 current_tracer\n-rw-r----- 1 root tracing 0 May 1 21:25 dynamic_events\n-r--r----- 1 root tracing 0 May 1 21:25 dyn_ftrace_total_info\n-r--r----- 1 root tracing 0 May 1 21:25 enabled_functions\nEverything changed but the \"current_tracer\".\nAdd a new link list that keeps track of all the tracefs_inodes which has\nthe permission flags that tell if the file/dir should use the root inode's\npermission or not. Then on remount, clear all the flags so that the\ndefault behavior of using the root inode's permission is done for all\nfiles and directories."], "name": "CVE-2024-36963", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-06-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-36963\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-36963\nhttps://lore.kernel.org/linux-cve-announce/2024060344-CVE-2024-36963-b8cc@gregkh/T"], "threat_severity": "Low"}

{"created": "2025-07-13T11:14:14.595228+00:00", "updated": "2025-07-13T11:14:14.595302+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}