CVE-2024-35955

2024-05-2000:00:00

ubuntu.com

linux

kernel

kprobes

vulnerability

fix

module state

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.6

Confidence

High

EPSS

Percentile

13.0%

JSON

In the Linux kernel, the following vulnerability has been resolved:
kprobes: Fix possible use-after-free issue on kprobe registration When
unloading a module, its state is changing MODULE_STATE_LIVE ->
MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take a time.
is_module_text_address() and __module_text_address() works with
MODULE_STATE_LIVE and MODULE_STATE_GOING. If we use
is_module_text_address() and __module_text_address() separately, there
is a chance that the first one is succeeded but the next one is failed
because module->state becomes MODULE_STATE_UNFORMED between those
operations. In check_kprobe_address_safe(), if the second
__module_text_address() is failed, that is ignored because it expected a
kernel_text address. But it may have failed simply because module->state
has been changed to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will
try to modify non-exist module text address (use-after-free). To fix this
problem, we should not use separated is_module_text_address() and
__module_text_address(), but use only __module_text_address() once and
do try_module_get(module) which is only available with MODULE_STATE_LIVE.

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchlinux< 5.4.0-189.209UNKNOWN
ubuntu22.04noarchlinux< 5.15.0-116.126UNKNOWN
ubuntu24.04noarchlinux< 6.8.0-38.38UNKNOWN
ubuntu20.04noarchlinux-aws< 5.4.0-1128.138UNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1065.71UNKNOWN
ubuntu24.04noarchlinux-aws< 6.8.0-1011.12UNKNOWN
ubuntu20.04noarchlinux-aws-5.15< 5.15.0-1065.71~20.04.1UNKNOWN
ubuntu18.04noarchlinux-aws-5.4< anyUNKNOWN
ubuntu22.04noarchlinux-aws-6.5< anyUNKNOWN
ubuntu20.04noarchlinux-azure< 5.4.0-1133.140UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	20.04	noarch	linux	< 5.4.0-189.209	UNKNOWN
ubuntu	22.04	noarch	linux	< 5.15.0-116.126	UNKNOWN
ubuntu	24.04	noarch	linux	< 6.8.0-38.38	UNKNOWN
ubuntu	20.04	noarch	linux-aws	< 5.4.0-1128.138	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< 5.15.0-1065.71	UNKNOWN
ubuntu	24.04	noarch	linux-aws	< 6.8.0-1011.12	UNKNOWN
ubuntu	20.04	noarch	linux-aws-5.15	< 5.15.0-1065.71~20.04.1	UNKNOWN
ubuntu	18.04	noarch	linux-aws-5.4	< any	UNKNOWN
ubuntu	22.04	noarch	linux-aws-6.5	< any	UNKNOWN
ubuntu	20.04	noarch	linux-azure	< 5.4.0-1133.140	UNKNOWN