CVE-2024-35955

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

kprobes: Fix possible use-after-free issue on kprobe registration

When unloading a module, its state is changing MODULE_STATE_LIVE ->

MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take

a time. `is_module_text_address()` and `__module_text_address()`

works with MODULE_STATE_LIVE and MODULE_STATE_GOING.

If we use `is_module_text_address()` and `__module_text_address()`

separately, there is a chance that the first one is succeeded but the

next one is failed because module->state becomes MODULE_STATE_UNFORMED

between those operations.

In `check_kprobe_address_safe()`, if the second `__module_text_address()`

is failed, that is ignored because it expected a kernel_text address.

But it may have failed simply because module->state has been changed

to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify

non-exist module text address (use-after-free).

To fix this problem, we should not use se

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References