CVE-2022-49721

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

arm64: ftrace: consistently handle PLTs.

Sometimes it is necessary to use a PLT entry to call an ftrace

trampoline. This is handled by ftrace_make_call() and ftrace_make_nop(),

with each having *almost* identical logic, but this is not handled by

ftrace_modify_call() since its introduction in commit:

3b23e4991fb66f6d ("arm64: implement ftrace with regs")

Due to this, if we ever were to call ftrace_modify_call() for a callsite

which requires a PLT entry for a trampoline, then either:

a) If the old addr requires a trampoline, ftrace_modify_call() will use

an out-of-range address to generate the 'old' branch instruction.

This will result in warnings from aarch64_insn_gen_branch_imm() and

ftrace_modify_code(), and no instructions will be modified. As

ftrace_modify_call() will return an error, this will result in

subsequent internal ftrace errors.

b) If the old addr does not require a trampoline, but

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References