Skip to content
Heist/ feed
High

ftrace: Fix use-after-free for dynamic ftrace_ops

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix use-after-free for dynamic ftrace_ops KASAN reported a use-after-free with ftrace ops [1]. It was found from vmcore that perf had registered two ops with the same content successively, both dynamic. After unregistering the second ops, a use-after-free occurred. In ftrace_shutdown(), when the second ops is unregistered, the FTRACE_UPDATE_CALLS command is not set because there is another enabled ops with the same content. Also, both ops are dynamic and the ftrace callback function is ftrace_ops_list_func, so the FTRACE_UPDATE_TRACE_FUNC command will not be set. Eventually the value of 'command' will be 0 and ftrace_shutdown() will skip the rcu synchronization. However, ftrace may be activated. When the ops is released, another CPU may be accessing the ops. Add the missing synchronization to fix this problem. [1] BUG: KASAN: use-after-free in __ftrace_ops_list_func kernel/trace/ftrace.c:7020 [inline] BUG: KASAN: use-after-free in ftrace_ops_list_func+0x2b0/0x31c kernel/trace/ftrace.c:7049 Read of size 8 at addr ffff56551965bbc8 by task syz-executor.2/14468 CPU: 1 PID: 14468 Comm: syz-executor.2 Not tainted 5.10.0 #7 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x40c arch/arm64/kernel/stacktrace.c:132 show_stack+0x30/0x40 arch/arm64/kernel/stacktrace.c:196 __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b4/0x248 lib/dump_stack.c:118 print_address_description.constprop.0+

Announced Source revision 1
Original source ↗

CVE-2022-49892

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2022-49892

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "edb096e00724f02db5f6ec7900f3bbd465c6c76f",
        "lessThan": "ea5f2fd4640ecbb9df969bf8bb27733ae2183169",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "edb096e00724f02db5f6ec7900f3bbd465c6c76f",
        "lessThan": "88561a66777e7a2fe06638c6dcb22a9fae0b6733",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "edb096e00724f02db5f6ec7900f3bbd465c6c76f",
        "lessThan": "cc1b9961a0ceb70f6ca4e2f4b8bb71c87c7a495c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "edb096e00724f02db5f6ec7900f3bbd465c6c76f",
        "lessThan": "0e792b89e6800cd9cb4757a76a96f7ef3e8b6294",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "a60e407b961e818541ff7924afa8e51fbdb21a61",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ed1bf4397d2219d4b9ec2d5517416ba102186650",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "100553e197e2c41eccf9fa04b2be9cd11ae21215",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "30d3c1c9c9dd31b3c3a5aa0f4f40f1e321c6c791",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "4.1.45",
        "lessThan": "4.2",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "4.4.89",
        "lessThan": "4.5",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "4.9.52",
        "lessThan": "4.10",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "4.13.4",
        "lessThan": "4.14",
        "versionType": "semver"
      }
    ],
    "programFiles": [
      "kernel/trace/ftrace.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.14"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.14",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.154",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.78",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.0.8",
        "versionType": "semver",
        "lessThanOrEqual": "6.0.*"
      },
      {
        "status": "unaffected",
        "version": "6.1",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "kernel/trace/ftrace.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2022-49892

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#30193 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement