In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: unexport _init-annotated seg6hmac_init()
EXPORTSYMBOL and _init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic.
modpost used to detect it, but it has been broken for a decade.
Recently, I fixed modpost so it started to warn it again, then this showed up in linux-next builds.
There are two ways to fix it:
I chose the latter for this case because the caller (net/ipv6/seg6.c) and the callee (net/ipv6/seg6_hmac.c) belong to the same module. It seems an internal function call in ipv6.ko.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49339.json",
"cna_assigner": "Linux"
}[
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"147871443098813503712275365862900019647",
"357524391660001363110578211593745617",
"18405908916313030511507287176224387008",
"229760980613386180392532467895858641225"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1084716f76c8045eadf92a9d9a62641f3c8d8c90",
"id": "CVE-2022-49339-d489d8dc",
"target": {
"file": "net/ipv6/seg6_hmac.c"
},
"signature_version": "v1",
"deprecated": false
}
]