Vulnerability in Kernel (CVE-2024-56560)

Summary

Vulnerability in Kernel (CVE-2024-56560). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 6.12.4 or later.

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

slab: Fix too strict alignment check in create_cache()

On m68k, where the minimum alignment of unsigned long is 2 bytes:

Kernel panic - not syncing: __kmem_cache_create_args: Failed to create slab 'io_kiocb'. Error -22
CPU: 0 UID: 0 PID: 1 Comm: swapper Not tainted 6.12.0-atari-03776-g7eaa1f99261a #1783
Stack from 0102fe5c:
    0102fe5c 00514a2b 00514a2b ffffff00 00000001 0051f5ed 00425e78 00514a2b
    0041eb74 ffffffea 00000310 0051f5ed ffffffea ffffffea 00601f60 00000044
    0102ff20 000e7a68 0051ab8e 004383b8 0051f5ed ffffffea 000000b8 00000007
    01020c00 00000000 000e77f0 0041e5f0 005f67c0 0051f5ed 000000b6 0102fef4
    00000310 0102fef4 00000000 00000016 005f676c 0060a34c 00000010 00000004
    00000038 0000009a 01000000 000000b8 005f668e 0102e000 00001372 0102ff88
Call Trace: [<00425e78>] dump_stack+0xc/0x10
 [<0041eb74>] panic+0xd8/0x26c
 [<000e7a68>] __kmem_cache_create_args+0x278/0x2e8
 [<000e77f0>] __kmem_cache_create_args+0x0/0x2e8
 [<0041e5f0>] memset+0x0/0x8c
 [<005f67c0>] io_uring_init+0x54/0xd2

The minimal alignment of an integral type may differ from its size,
hence is not safe to assume that an arbitrary freeptr_t (which is
basically an unsigned long) is always aligned to 4 or 8 bytes.

As nothing seems to require the additional alignment, it is safe to fix
this by relaxing the check to the actual minimum alignment of freeptr_t.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2024-56560 has been found in Kernel.
Risk of unauthorized operations or information disclosure.
What to do: upgrade Kernel to 6.12.4 or later.
If unsure, ask your IT team or search "Kernel CVE-2024-56560" on the vendor's site.

CVE-2024-56560 (Kernel)
Patched: 6.12.4 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (unclassified) exists in Kernel.

📍 Affected scope

Check the vendor advisory for the affected versions of Kernel.

🔥 Severity

Severity: ?. Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 6.12.4.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'Kernel' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'Kernel' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で Kernel を grep し、稼働しているサービス・バージョンを把握する。
2
Apply patch patch
```
Upgrade Kernel to 6.12.4
```
ステージング環境で 6.12.4 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
3
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.0"},{"fixed":"6.12.4"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

BellSoft Alpaquita BELL-CVE-2024-56560 linux-lts Fixed in: 6.12.41-r0
Debian DEBIAN-CVE-2024-56560 linux Fixed in: 6.12.5-1