IM
IronMonkey Threat Research

CVE-2024-35955 HIGH

Published: 2024-05-20 | Last Modified: 2026-05-12 | Status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration When unloading a module, its state is changing MODULE_STATE_LIVE -> MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take a time. `is_module_text_address()` and `__module_text_address()` works with MODULE_STATE_LIVE and MODULE_STATE_GOING. If we use `is_module_text_address()` and `__module_text_address()` separately, there is a chance that the first one is succeeded but the next one is failed because module->state becomes MODULE_STATE_UNFORMED between those operations. In `check_kprobe_address_safe()`, if the second `__module_text_address()` is failed, that is ignored because it expected a kernel_text address. But it may have failed simply because module->state has been changed to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify non-exist module text address (use-after-free). To fix this problem, we should not use separated `is_module_text_address()` and `__module_text_address()`, but use only `__module_text_address()` once and do `try_module_get(module)` which is only available with MODULE_STATE_LIVE.

Additional Descriptions (1)

En el kernel de Linux, se resolvió la siguiente vulnerabilidad: kprobes: soluciona un posible problema de use after free en el registro de kprobe Al descargar un módulo, su estado cambia MODULE_STATE_LIVE -> MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Cada cambio llevará un tiempo. `is_module_text_address()` y `__module_text_address()` funcionan con MODULE_STATE_LIVE y MODULE_STATE_GOING. Si usamos `is_module_text_address()` y `__module_text_address()` por separado, existe la posibilidad de que el primero tenga éxito pero el siguiente falle porque module->state se convierte en MODULE_STATE_UNFORMED entre esas operaciones. En `check_kprobe_address_safe()`, si el segundo `__module_text_address()` falla, se ignora porque esperaba una dirección kernel_text. Pero es posible que haya fallado simplemente porque módulo->estado se cambió a MODULE_STATE_UNFORMED. En este caso, arm_kprobe() intentará modificar la dirección de texto del módulo que no existe (use after free). Para solucionar este problema, no debemos usar `is_module_text_address()` y `__module_text_address()` separados, sino usar solo `__module_text_address()` una vez y hacer `try_module_get(module)` que solo está disponible con MODULE_STATE_LIVE.

CVSS Metrics

Base Score: 8.8 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Type: Secondary

Exploitability Score: 2.8

Impact Score: 5.9

Weaknesses

Source Type Description
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-416

Affected Products

Vendor Product Version Update Type
linux linux_kernel * <built-in method update of dict object at 0x7fd370379b40> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd3412f4540> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd342602c40> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd342603280> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd342602280> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd3426010c0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd342602840> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd3703446c0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd3412f5ec0> Operating System
linux linux_kernel 6.9 <built-in method update of dict object at 0x7fd342602480> Operating System
linux linux_kernel 6.9 <built-in method update of dict object at 0x7fd39c47b300> Operating System
linux linux_kernel 6.9 <built-in method update of dict object at 0x7fd384a80400> Operating System
debian debian_linux 10.0 <built-in method update of dict object at 0x7fd36a6e7a00> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

References