CVE-2024-35955: kprobes: Fix possible use-after-free issue on kprobe registration
In the Linux kernel, the following vulnerability has been resolved:
kprobes: Fix possible use-after-free issue on kprobe registration
When unloading a module, its state is changing MODULESTATELIVE -> MODULESTATEGOING -> MODULESTATEUNFORMED. Each change will take a time. ismoduletextaddress() and moduletextaddress() works with MODULESTATELIVE and MODULESTATEGOING. If we use ismoduletextaddress() and moduletextaddress() separately, there is a chance that the first one is succeeded but the next one is failed because module->state becomes MODULESTATEUNFORMED between those operations.
In checkkprobeaddresssafe(), if the second moduletextaddress() is failed, that is ignored because it expected a kerneltext address. But it may have failed simply because module->state has been changed to MODULESTATEUNFORMED. In this case, armkprobe() will try to modify non-exist module text address (use-after-free).
To fix this problem, we should not use separated ismoduletextaddress() and moduletextaddress(), but use only moduletextaddress() once and do trymoduleget(module) which is only available with MODULESTATELIVE.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35955?
The severity of CVE-2024-35955 is classified as medium due to possible use-after-free issues in the Linux kernel.
How do I fix CVE-2024-35955?
To fix CVE-2024-35955, ensure that your system is updated to the latest patched versions of the Linux kernel: 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.10-1, or 6.12.11-1.
Which versions of the Linux kernel are affected by CVE-2024-35955?
CVE-2024-35955 affects several versions of the Linux kernel including those prior to the fixed versions 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.10-1, and 6.12.11-1.
What causes the use-after-free vulnerability in CVE-2024-35955?
The use-after-free vulnerability in CVE-2024-35955 is caused by state change issues during the unloading of kernel modules.
Is CVE-2024-35955 exploitable remotely?
CVE-2024-35955 is typically not exploitable remotely as it requires local access to execute kernel module operations.