In the Linux kernel, the following vulnerability has been resolved:
kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address
Read from an unsafe address with copy_from_kernel_nofault() in
arch_adjust_kprobe_addr() because this function is used before checking
the address is in text or not. Syzcaller bot found a bug and reported
the case if user specifies inaccessible data area,
arch_adjust_kprobe_addr() will cause a kernel panic.
[ mingo: Clarified the comment. ]
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "cc66bb914578",
"lessThan": "641768431508",
"versionType": "git"
},
{
"status": "affected",
"version": "cc66bb914578",
"lessThan": "f13edd1871d4",
"versionType": "git"
},
{
"status": "affected",
"version": "cc66bb914578",
"lessThan": "20fdb21eabae",
"versionType": "git"
},
{
"status": "affected",
"version": "cc66bb914578",
"lessThan": "b69f577308f1",
"versionType": "git"
},
{
"status": "affected",
"version": "cc66bb914578",
"lessThan": "4e51653d5d87",
"versionType": "git"
}
],
"programFiles": [
"arch/x86/kernel/kprobes/core.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.18",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.1.84",
"versionType": "custom",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.24",
"versionType": "custom",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.7.12",
"versionType": "custom",
"lessThanOrEqual": "6.7.*"
},
{
"status": "unaffected",
"version": "6.8.3",
"versionType": "custom",
"lessThanOrEqual": "6.8.*"
},
{
"status": "unaffected",
"version": "6.9",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"arch/x86/kernel/kprobes/core.c"
],
"defaultStatus": "affected"
}
]
git.kernel.org/stable/c/20fdb21eabaeb8f78f8f701f56d14ea0836ec861
git.kernel.org/stable/c/4e51653d5d871f40f1bd5cf95cc7f2d8b33d063b
git.kernel.org/stable/c/6417684315087904fffe8966d27ca74398c57dd6
git.kernel.org/stable/c/b69f577308f1070004cafac106dd1a44099e5483
git.kernel.org/stable/c/f13edd1871d4fb4ab829aff629d47914e251bae3