In the Linux kernel, the following vulnerability has been resolved:
kprobes: Fix possible use-after-free issue on kprobe registration
When unloading a module, its state is changing MODULESTATELIVE ->
MODULESTATEGOING -> MODULESTATEUNFORMED. Each change will take
a time. is_module_text_address() and __module_text_address()
works with MODULESTATELIVE and MODULESTATEGOING.
If we use is_module_text_address() and __module_text_address()
separately, there is a chance that the first one is succeeded but the
next one is failed because module->state becomes MODULESTATEUNFORMED
between those operations.
In check_kprobe_address_safe(), if the second __module_text_address()
is failed, that is ignored because it expected a kerneltext address.
But it may have failed simply because module->state has been changed
to MODULESTATEUNFORMED. In this case, armkprobe() will try to modify
non-exist module text address (use-after-free).
To fix this problem, we should not use separated is_module_text_address()
and __module_text_address(), but use only __module_text_address()
once and do try_module_get(module) which is only available with
MODULESTATELIVE.
[
{
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d15023fb407337028a654237d8968fefdcf87c2f",
"target": {
"file": "kernel/kprobes.c",
"function": "check_kprobe_address_safe"
},
"id": "CVE-2024-35955-18cb7363",
"digest": {
"function_hash": "151710302541924943862775851707716708106",
"length": 954.0
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62029bc9ff2c17a4e3a2478d83418ec575413808",
"target": {
"file": "kernel/kprobes.c",
"function": "check_kprobe_address_safe"
},
"id": "CVE-2024-35955-23c96149",
"digest": {
"function_hash": "151710302541924943862775851707716708106",
"length": 954.0
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8",
"target": {
"file": "kernel/kprobes.c"
},
"id": "CVE-2024-35955-3a2ba6be",
"digest": {
"line_hashes": [
"321228753813921900157457115404683691626",
"161320004964371357527962893858704673421",
"293936307832619274830367768925700028382",
"41070277496170440920114677501116277010",
"79764382330736553832510150529928992635",
"262658894545342927655942070098558510675",
"19044034726608338195234239562471540496",
"177882168538013591191407548121796909523",
"64130134141549153833364029352846926208",
"209186017916841610179375456026757802517"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8",
"target": {
"file": "kernel/kprobes.c",
"function": "check_kprobe_address_safe"
},
"id": "CVE-2024-35955-4946cad9",
"digest": {
"function_hash": "151710302541924943862775851707716708106",
"length": 954.0
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d15023fb407337028a654237d8968fefdcf87c2f",
"target": {
"file": "kernel/kprobes.c"
},
"id": "CVE-2024-35955-4abfd45e",
"digest": {
"line_hashes": [
"321228753813921900157457115404683691626",
"161320004964371357527962893858704673421",
"293936307832619274830367768925700028382",
"41070277496170440920114677501116277010",
"79764382330736553832510150529928992635",
"262658894545342927655942070098558510675",
"19044034726608338195234239562471540496",
"177882168538013591191407548121796909523",
"64130134141549153833364029352846926208",
"209186017916841610179375456026757802517"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93eb31e7c3399e326259f2caa17be1e821f5a412",
"target": {
"file": "kernel/kprobes.c"
},
"id": "CVE-2024-35955-61ea07b1",
"digest": {
"line_hashes": [
"321228753813921900157457115404683691626",
"161320004964371357527962893858704673421",
"293936307832619274830367768925700028382",
"41070277496170440920114677501116277010",
"79764382330736553832510150529928992635",
"318615946251897923067516853590250854145",
"19044034726608338195234239562471540496",
"177882168538013591191407548121796909523",
"64130134141549153833364029352846926208",
"209186017916841610179375456026757802517"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2df2dd27066cdba8041e46a64362325626bdfb2e",
"target": {
"file": "kernel/kprobes.c",
"function": "check_kprobe_address_safe"
},
"id": "CVE-2024-35955-738666db",
"digest": {
"function_hash": "151710302541924943862775851707716708106",
"length": 954.0
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36b57c7d2f8b7de224980f1a284432846ad71ca0",
"target": {
"file": "kernel/kprobes.c",
"function": "check_kprobe_address_safe"
},
"id": "CVE-2024-35955-7599abba",
"digest": {
"function_hash": "151710302541924943862775851707716708106",
"length": 954.0
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5808d40093403334d939e2c3c417144d12a6f33",
"target": {
"file": "kernel/kprobes.c"
},
"id": "CVE-2024-35955-9ec89a7c",
"digest": {
"line_hashes": [
"321228753813921900157457115404683691626",
"161320004964371357527962893858704673421",
"293936307832619274830367768925700028382",
"41070277496170440920114677501116277010",
"79764382330736553832510150529928992635",
"318615946251897923067516853590250854145",
"19044034726608338195234239562471540496",
"177882168538013591191407548121796909523",
"64130134141549153833364029352846926208",
"209186017916841610179375456026757802517"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36b57c7d2f8b7de224980f1a284432846ad71ca0",
"target": {
"file": "kernel/kprobes.c"
},
"id": "CVE-2024-35955-a2752675",
"digest": {
"line_hashes": [
"321228753813921900157457115404683691626",
"161320004964371357527962893858704673421",
"293936307832619274830367768925700028382",
"41070277496170440920114677501116277010",
"79764382330736553832510150529928992635",
"262658894545342927655942070098558510675",
"19044034726608338195234239562471540496",
"177882168538013591191407548121796909523",
"64130134141549153833364029352846926208",
"209186017916841610179375456026757802517"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5062d1f4f07facbdade0f402d9a04a788f52e26d",
"target": {
"file": "kernel/kprobes.c"
},
"id": "CVE-2024-35955-b0128628",
"digest": {
"line_hashes": [
"321228753813921900157457115404683691626",
"161320004964371357527962893858704673421",
"293936307832619274830367768925700028382",
"41070277496170440920114677501116277010",
"79764382330736553832510150529928992635",
"262658894545342927655942070098558510675",
"19044034726608338195234239562471540496",
"177882168538013591191407548121796909523",
"64130134141549153833364029352846926208",
"209186017916841610179375456026757802517"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5062d1f4f07facbdade0f402d9a04a788f52e26d",
"target": {
"file": "kernel/kprobes.c",
"function": "check_kprobe_address_safe"
},
"id": "CVE-2024-35955-b3ad5627",
"digest": {
"function_hash": "151710302541924943862775851707716708106",
"length": 954.0
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5808d40093403334d939e2c3c417144d12a6f33",
"target": {
"file": "kernel/kprobes.c",
"function": "check_kprobe_address_safe"
},
"id": "CVE-2024-35955-b764181b",
"digest": {
"function_hash": "230757657600460257851021916636353808891",
"length": 859.0
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93eb31e7c3399e326259f2caa17be1e821f5a412",
"target": {
"file": "kernel/kprobes.c",
"function": "check_kprobe_address_safe"
},
"id": "CVE-2024-35955-be7ac22c",
"digest": {
"function_hash": "230757657600460257851021916636353808891",
"length": 859.0
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62029bc9ff2c17a4e3a2478d83418ec575413808",
"target": {
"file": "kernel/kprobes.c"
},
"id": "CVE-2024-35955-bf2bcd8d",
"digest": {
"line_hashes": [
"321228753813921900157457115404683691626",
"161320004964371357527962893858704673421",
"293936307832619274830367768925700028382",
"41070277496170440920114677501116277010",
"79764382330736553832510150529928992635",
"262658894545342927655942070098558510675",
"19044034726608338195234239562471540496",
"177882168538013591191407548121796909523",
"64130134141549153833364029352846926208",
"209186017916841610179375456026757802517"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2df2dd27066cdba8041e46a64362325626bdfb2e",
"target": {
"file": "kernel/kprobes.c"
},
"id": "CVE-2024-35955-cf2752da",
"digest": {
"line_hashes": [
"321228753813921900157457115404683691626",
"161320004964371357527962893858704673421",
"293936307832619274830367768925700028382",
"41070277496170440920114677501116277010",
"79764382330736553832510150529928992635",
"262658894545342927655942070098558510675",
"19044034726608338195234239562471540496",
"177882168538013591191407548121796909523",
"64130134141549153833364029352846926208",
"209186017916841610179375456026757802517"
],
"threshold": 0.9
},
"signature_version": "v1"
}
]