Tracker / CVE-2024-35955
CVE-2024-35955
In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration When unloading a module, its state is changing MODULE_STATE_LIVE -> MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take a time. `is_module_text_address()` and `__module_text_address()` works with MODULE_STATE_LIVE and MODULE_STATE_GOING. If we use `is_module_text_address()` and `__module_text_address()` separately, there is a chance that the first one is succeeded but the next one is failed because module->state becomes MODULE_STATE_UNFORMED between those operations. In `check_kprobe_address_safe()`, if the second `__module_text_address()` is failed, that is ignored because it expected a kernel_text address. But it may have failed simply because module->state has been changed to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify non-exist module text address (use-after-free). To fix this problem, we should not use separated `is_module_text_address()` and `__module_text_address()`, but use only `__module_text_address()` once and do `try_module_get(module)` which is only available with MODULE_STATE_LIVE.
Prodotti e versioni affette
| debian | debian_linux |
|---|---|
| linux | linux_kernel |
| linux | linux_kernel · 4.14.291 → 4.15 |
| linux | linux_kernel · 4.19.256 → 4.19.313 |
| linux | linux_kernel · 5.10.137 → 5.10.216 |
| linux | linux_kernel · 5.15.61 → 5.15.157 |
| linux | linux_kernel · 5.18.18 → 5.19 |
| linux | linux_kernel · 5.19.2 → 6.1.87 |
| linux | linux_kernel · 5.4.211 → 5.4.275 |
| linux | linux_kernel · 6.2 → 6.6.28 |
| linux | linux_kernel · 6.7 → 6.8.7 |