Description
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix null pointer dereference in ftrace_add_mod() The @ftrace_mod is allocated by kzalloc(), so both the members {prev,next} of @ftrace_mode->list are NULL, it's not a valid state to call list_del(). If kstrdup() for @ftrace_mod->{func|module} fails, it goes to @out_free tag and calls free_ftrace_mod() to destroy @ftrace_mod, then list_del() will write prev->next and next->prev, where null pointer dereference happens. BUG: kernel NULL pointer dereference, address: 0000000000000008 Oops: 0002 [#1] PREEMPT SMP NOPTI Call Trace: <TASK> ftrace_mod_callback+0x20d/0x220 ? do_filp_open+0xd9/0x140 ftrace_process_regex.isra.51+0xbf/0x130 ftrace_regex_write.isra.52.part.53+0x6e/0x90 vfs_write+0xee/0x3a0 ? __audit_filter_op+0xb1/0x100 ? auditd_test_task+0x38/0x50 ksys_write+0xa5/0xe0 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Kernel panic - not syncing: Fatal exception So call INIT_LIST_HEAD() to initialize the list member to fix this issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
673feb9d76ab3eddde7acfd94b206e321cfc90b9 to < 665b4c6648bf2b91f69b33817f4321cf4c3cafe9affected673feb9d76ab3eddde7acfd94b206e321cfc90b9 to < b5bfc61f541d3f092b13dedcfe000d86eb8e133caffected673feb9d76ab3eddde7acfd94b206e321cfc90b9 to < f715f31559b82e3f75ce047fa476de63d8107584affected673feb9d76ab3eddde7acfd94b206e321cfc90b9 to < 6a14828caddad0d989495a72af678adf60992704affected673feb9d76ab3eddde7acfd94b206e321cfc90b9 to < 1bea037a1abb23a6729bef36a2265a4565f5ea77affected673feb9d76ab3eddde7acfd94b206e321cfc90b9 to < 6e50eb4b1807017f6c2d5089064256ce2de8aef1affected673feb9d76ab3eddde7acfd94b206e321cfc90b9 to < 19ba6c8af9382c4c05dc6a0a79af3013b9a35cd0affected
Linux Linux
Default version status: affected
4.13affected0 to < 4.13unaffected4.14.300 to ≤ 4.14.*unaffected4.19.267 to ≤ 4.19.*unaffected5.4.225 to ≤ 5.4.*unaffected5.10.156 to ≤ 5.10.*unaffected5.15.80 to ≤ 5.15.*unaffected6.0.10 to ≤ 6.0.*unaffected6.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/665b4c6648bf2b91f69b33817f4321cf4c3cafe9 ↗
- https://git.kernel.org/stable/c/b5bfc61f541d3f092b13dedcfe000d86eb8e133c ↗
- https://git.kernel.org/stable/c/f715f31559b82e3f75ce047fa476de63d8107584 ↗
- https://git.kernel.org/stable/c/6a14828caddad0d989495a72af678adf60992704 ↗
- https://git.kernel.org/stable/c/1bea037a1abb23a6729bef36a2265a4565f5ea77 ↗
- https://git.kernel.org/stable/c/6e50eb4b1807017f6c2d5089064256ce2de8aef1 ↗
- https://git.kernel.org/stable/c/19ba6c8af9382c4c05dc6a0a79af3013b9a35cd0 ↗