CVE-2024-35955

Summary

In the Linux kernel, the following vulnerability has been resolved:

kprobes: Fix possible use-after-free issue on kprobe registration

When unloading a module, its state is changing MODULE_STATE_LIVE -> MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take a time. is_module_text_address() and __module_text_address() works with MODULE_STATE_LIVE and MODULE_STATE_GOING. If we use is_module_text_address() and __module_text_address() separately, there is a chance that the first one is succeeded but the next one is failed because module->state becomes MODULE_STATE_UNFORMED between those operations.

In check_kprobe_address_safe(), if the second __module_text_address() is failed, that is ignored because it expected a kernel_text address. But it may have failed simply because module->state has been changed to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify non-exist module text address (use-after-free).

To fix this problem, we should not use separated is_module_text_address() and __module_text_address(), but use only __module_text_address() once and do try_module_get(module) which is only available with MODULE_STATE_LIVE.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux1c836bad43f3e2ff71cc397a6e6ccb4e7bd116f8 < b5808d40093403334d939e2c3c417144d12a6f33affected
LinuxLinux6a119c1a584aa7a2c6216458f1f272bf1bc93a93 < 93eb31e7c3399e326259f2caa17be1e821f5a412affected
LinuxLinux2a49b025c36ae749cee7ccc4b7e456e02539cdc3 < 5062d1f4f07facbdade0f402d9a04a788f52e26daffected
LinuxLinuxa1edb85e60fdab1e14db63ae8af8db3f0d798fb6 < 2df2dd27066cdba8041e46a64362325626bdfb2eaffected
LinuxLinux28f6c37a2910f565b4f5960df52b2eccae28c891 < 62029bc9ff2c17a4e3a2478d83418ec575413808affected
LinuxLinux28f6c37a2910f565b4f5960df52b2eccae28c891 < d15023fb407337028a654237d8968fefdcf87c2faffected
LinuxLinux28f6c37a2910f565b4f5960df52b2eccae28c891 < 36b57c7d2f8b7de224980f1a284432846ad71ca0affected
LinuxLinux28f6c37a2910f565b4f5960df52b2eccae28c891 < 325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8affected
LinuxLinux4262b6eb057d86c7829168c541654fe0d48fdac8affected
LinuxLinux97e813e6a143edf4208e15c72199c495ed80cea5affected
LinuxLinux16a544f1e013ba0660612f3fe35393b143b19a84affected
LinuxLinux4.19.256 < 4.19.313affected
LinuxLinux5.4.211 < 5.4.275affected
LinuxLinux5.10.137 < 5.10.216affected
LinuxLinux5.15.61 < 5.15.157affected
LinuxLinux4.14.291 < 4.15affected
LinuxLinux5.18.18 < 5.19affected
LinuxLinux5.19.2 < 5.20affected
LinuxLinux6.0affected
LinuxLinux0 < 6.0unaffected
LinuxLinux4.19.313 <= 4.19.*unaffected
LinuxLinux5.4.275 <= 5.4.*unaffected
LinuxLinux5.10.216 <= 5.10.*unaffected
LinuxLinux5.15.157 <= 5.15.*unaffected
LinuxLinux6.1.87 <= 6.1.*unaffected
LinuxLinux6.6.28 <= 6.6.*unaffected
LinuxLinux6.8.7 <= 6.8.*unaffected
LinuxLinux6.9 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

CVE Program Container

Additional References

Additional References

References