CVE-2022-49802

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Fix null pointer dereference in ftrace_add_mod()

The @ftrace_mod is allocated by kzalloc(), so both the members {prev,next}

of @ftrace_mode->list are NULL, it's not a valid state to call list_del().

If kstrdup() for @ftrace_mod->{func|module} fails, it goes to @out_free

tag and calls free_ftrace_mod() to destroy @ftrace_mod, then list_del()

will write prev->next and next->prev, where null pointer dereference

happens.

BUG: kernel NULL pointer dereference, address: 0000000000000008

Oops: 0002 [#1] PREEMPT SMP NOPTI

Call Trace:

<TASK>

ftrace_mod_callback+0x20d/0x220

? do_filp_open+0xd9/0x140

ftrace_process_regex.isra.51+0xbf/0x130

ftrace_regex_write.isra.52.part.53+0x6e/0x90

vfs_write+0xee/0x3a0

? __audit_filter_op+0xb1/0x100

? auditd_test_task+0x38/0x50

ksys_write+0xa5/0xe0

do_syscall_64+0x3a/0x90

entry_SYSCALL_64_after_hwframe+0x63/0xcd

Kernel panic - not syncing: Fatal exception

So call INIT_LIST

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References