Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2024-35955

kprobes: Fix possible use-after-free issue on kprobe registration

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration When unloading a module, its state is changing MODULE_STATE_LIVE -> MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take a time. `is_module_text_address()` and `__module_text_address()` works with MODULE_STATE_LIVE and MODULE_STATE_GOING. If we use `is_module_text_address()` and `__module_text_address()` separately, there is a chance that the first one is succeeded but the next one is failed because module->state becomes MODULE_STATE_UNFORMED between those operations. In `check_kprobe_address_safe()`, if the second `__module_text_address()` is failed, that is ignored because it expected a kernel_text address. But it may have failed simply because module->state has been changed to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify non-exist module text address (use-after-free). To fix this problem, we should not use separated `is_module_text_address()` and `__module_text_address()`, but use only `__module_text_address()` once and do `try_module_get(module)` which is only available with MODULE_STATE_LIVE.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 1c836bad43f3e2ff71cc397a6e6ccb4e7bd116f8 to < b5808d40093403334d939e2c3c417144d12a6f33affected
  • 6a119c1a584aa7a2c6216458f1f272bf1bc93a93 to < 93eb31e7c3399e326259f2caa17be1e821f5a412affected
  • 2a49b025c36ae749cee7ccc4b7e456e02539cdc3 to < 5062d1f4f07facbdade0f402d9a04a788f52e26daffected
  • a1edb85e60fdab1e14db63ae8af8db3f0d798fb6 to < 2df2dd27066cdba8041e46a64362325626bdfb2eaffected
  • 28f6c37a2910f565b4f5960df52b2eccae28c891 to < 62029bc9ff2c17a4e3a2478d83418ec575413808affected
  • 28f6c37a2910f565b4f5960df52b2eccae28c891 to < d15023fb407337028a654237d8968fefdcf87c2faffected
  • 28f6c37a2910f565b4f5960df52b2eccae28c891 to < 36b57c7d2f8b7de224980f1a284432846ad71ca0affected
  • 28f6c37a2910f565b4f5960df52b2eccae28c891 to < 325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8affected
  • 4262b6eb057d86c7829168c541654fe0d48fdac8affected
  • 97e813e6a143edf4208e15c72199c495ed80cea5affected
  • 16a544f1e013ba0660612f3fe35393b143b19a84affected
  • 4.19.256 to < 4.19.313affected
  • 5.4.211 to < 5.4.275affected
  • 5.10.137 to < 5.10.216affected
  • 5.15.61 to < 5.15.157affected
  • 4.14.291 to < 4.15affected
  • 5.18.18 to < 5.19affected
  • 5.19.2 to < 5.20affected

Linux Linux

Default version status: affected

  • 6.0affected
  • 0 to < 6.0unaffected
  • 4.19.313 to ≤ 4.19.*unaffected
  • 5.4.275 to ≤ 5.4.*unaffected
  • 5.10.216 to ≤ 5.10.*unaffected
  • 5.15.157 to ≤ 5.15.*unaffected
  • 6.1.87 to ≤ 6.1.*unaffected
  • 6.6.28 to ≤ 6.6.*unaffected
  • 6.8.7 to ≤ 6.8.*unaffected
  • 6.9 to ≤ *unaffected

References