ftrace: Fix use-after-free for dynamic ftrace_ops
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix use-after-free for dynamic ftrace_ops KASAN reported a use-after-free with ftrace ops [1]. It was found from vmcore that perf had registered two ops with the same content successively, both dynamic. After unregistering the second ops, a use-after-free occurred. In ftrace_shutdown(), when the second ops is unregistered, the FTRACE_UPDATE_CALLS command is not set because there is another enabled ops with the same content. Also, both ops are dynamic and the ftrace callback function is ftrace_ops_list_func, so the FTRACE_UPDATE_TRACE_FUNC command will not be set. Eventually the value of 'command' will be 0 and ftrace_shutdown() will skip the rcu synchronization. However, ftrace may be activated. When the ops is released, another CPU may be accessing the ops. Add the missing synchronization to fix this problem. [1] BUG: KASAN: use-after-free in __ftrace_ops_list_func kernel/trace/ftrace.c:7020 [inline] BUG: KASAN: use-after-free in ftrace_ops_list_func+0x2b0/0x31c kernel/trace/ftrace.c:7049 Read of size 8 at addr ffff56551965bbc8 by task syz-executor.2/14468 CPU: 1 PID: 14468 Comm: syz-executor.2 Not tainted 5.10.0 #7 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x40c arch/arm64/kernel/stacktrace.c:132 show_stack+0x30/0x40 arch/arm64/kernel/stacktrace.c:196 __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b4/0x248 lib/dump_stack.c:118 print_address_description.constprop.0+
CVE-2022-49892
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2022-49892
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "edb096e00724f02db5f6ec7900f3bbd465c6c76f",
"lessThan": "ea5f2fd4640ecbb9df969bf8bb27733ae2183169",
"versionType": "git"
},
{
"status": "affected",
"version": "edb096e00724f02db5f6ec7900f3bbd465c6c76f",
"lessThan": "88561a66777e7a2fe06638c6dcb22a9fae0b6733",
"versionType": "git"
},
{
"status": "affected",
"version": "edb096e00724f02db5f6ec7900f3bbd465c6c76f",
"lessThan": "cc1b9961a0ceb70f6ca4e2f4b8bb71c87c7a495c",
"versionType": "git"
},
{
"status": "affected",
"version": "edb096e00724f02db5f6ec7900f3bbd465c6c76f",
"lessThan": "0e792b89e6800cd9cb4757a76a96f7ef3e8b6294",
"versionType": "git"
},
{
"status": "affected",
"version": "a60e407b961e818541ff7924afa8e51fbdb21a61",
"versionType": "git"
},
{
"status": "affected",
"version": "ed1bf4397d2219d4b9ec2d5517416ba102186650",
"versionType": "git"
},
{
"status": "affected",
"version": "100553e197e2c41eccf9fa04b2be9cd11ae21215",
"versionType": "git"
},
{
"status": "affected",
"version": "30d3c1c9c9dd31b3c3a5aa0f4f40f1e321c6c791",
"versionType": "git"
},
{
"status": "affected",
"version": "4.1.45",
"lessThan": "4.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.4.89",
"lessThan": "4.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.9.52",
"lessThan": "4.10",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.13.4",
"lessThan": "4.14",
"versionType": "semver"
}
],
"programFiles": [
"kernel/trace/ftrace.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.14",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.154",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.78",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.0.8",
"versionType": "semver",
"lessThanOrEqual": "6.0.*"
},
{
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"kernel/trace/ftrace.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2022-49892
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30193 · Revision 1
- Added to Heist Feed
- Publisher date