CVE-2022-49236

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix UAF due to race between btf_try_get_module and load_module

While working on code to populate kfunc BTF ID sets for module BTF from

its initcall, I noticed that by the time the initcall is invoked, the

module BTF can already be seen by userspace (and the BPF verifier). The

existing btf_try_get_module calls try_module_get which only fails if

mod->state == MODULE_STATE_GOING, i.e. it can increment module reference

when module initcall is happening in parallel.

Currently, BTF parsing happens from MODULE_STATE_COMING notifier

callback. At this point, the module initcalls have not been invoked.

The notifier callback parses and prepares the module BTF, allocates an

ID, which publishes it to userspace, and then adds it to the btf_modules

list allowing the kernel to invoke btf_try_get_module for the BTF.

However, at this point, the module has not been fully initialized (i.e.

its initcalls have not finished). The co

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References