Lucene search

K
ubuntucveUbuntu.comUB:CVE-2024-35955
HistoryMay 20, 2024 - 12:00 a.m.

CVE-2024-35955

2024-05-2000:00:00
ubuntu.com
ubuntu.com
2
linux
kernel
kprobes
vulnerability
fix
module state

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.0%

In the Linux kernel, the following vulnerability has been resolved:
kprobes: Fix possible use-after-free issue on kprobe registration When
unloading a module, its state is changing MODULE_STATE_LIVE ->
MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take a time.
is_module_text_address() and __module_text_address() works with
MODULE_STATE_LIVE and MODULE_STATE_GOING. If we use
is_module_text_address() and __module_text_address() separately, there
is a chance that the first one is succeeded but the next one is failed
because module->state becomes MODULE_STATE_UNFORMED between those
operations. In check_kprobe_address_safe(), if the second
__module_text_address() is failed, that is ignored because it expected a
kernel_text address. But it may have failed simply because module->state
has been changed to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will
try to modify non-exist module text address (use-after-free). To fix this
problem, we should not use separated is_module_text_address() and
__module_text_address(), but use only __module_text_address() once and
do try_module_get(module) which is only available with MODULE_STATE_LIVE.

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.0%