Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of __register_event() in trace_module_add_events() trace_module_add_events() ignores the return value of __register_event() and unconditionally calls __add_event_to_tracers() for each event. If __register_event() fails (for example, if event_init() fails), the trace_event_call is not added to ftrace_events list, but __add_event_to_tracers() still creates a trace_event_file pointing to it. If module loading subsequently fails and module memory is freed, tracing state retains a stale trace_event_call pointer in trace_event_file, leading to a use-after-free when tracefs or tracing subsystem operations are later executed. Fix this by checking the return value of __register_event() and only calling __add_event_to_tracers() if event registration succeeded.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ae63b31e4d0e2ec09c569306ea46f664508ef717 to < 3bf965a2827c44f03294107703e7ba53fbd0a69aaffectedae63b31e4d0e2ec09c569306ea46f664508ef717 to < 9d6d79744f01eacaf3d5522f4fcd59939581abfdaffectedae63b31e4d0e2ec09c569306ea46f664508ef717 to < 54b7a358f6399c1242d2fb7f4f96085af34baa5eaffectedae63b31e4d0e2ec09c569306ea46f664508ef717 to < d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5affectedae63b31e4d0e2ec09c569306ea46f664508ef717 to < 22f954f7a8afe975e85517aff41b35defe05144baffectedae63b31e4d0e2ec09c569306ea46f664508ef717 to < cbb5ed3be9cae70e1c12b1991009b4e12bf4a4caaffectedae63b31e4d0e2ec09c569306ea46f664508ef717 to < 000765dcdc3edf128990762790543adc4b868f6caffectedae63b31e4d0e2ec09c569306ea46f664508ef717 to < ac8719969e6c3c54e939834df812bc41f25453cfaffected
Linux Linux
Default version status: affected
3.10affected0 to < 3.10unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.151 to ≤ 6.6.*unaffected6.12.103 to ≤ 6.12.*unaffected6.18.44 to ≤ 6.18.*unaffected7.1.8 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/3bf965a2827c44f03294107703e7ba53fbd0a69a ↗
- https://git.kernel.org/stable/c/9d6d79744f01eacaf3d5522f4fcd59939581abfd ↗
- https://git.kernel.org/stable/c/54b7a358f6399c1242d2fb7f4f96085af34baa5e ↗
- https://git.kernel.org/stable/c/d61ee2a27dfd5eb43ddc18af40168f5b9eb1cea5 ↗
- https://git.kernel.org/stable/c/22f954f7a8afe975e85517aff41b35defe05144b ↗
- https://git.kernel.org/stable/c/cbb5ed3be9cae70e1c12b1991009b4e12bf4a4ca ↗
- https://git.kernel.org/stable/c/000765dcdc3edf128990762790543adc4b868f6c ↗
- https://git.kernel.org/stable/c/ac8719969e6c3c54e939834df812bc41f25453cf ↗