CVE-2022-49779

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case

In __unregister_kprobe_top(), if the currently unregistered probe has

post_handler but other child probes of the aggrprobe do not have

post_handler, the post_handler of the aggrprobe is cleared. If this is

a ftrace-based probe, there is a problem. In later calls to

disarm_kprobe(), we will use kprobe_ftrace_ops because post_handler is

NULL. But we're armed with kprobe_ipmodify_ops. This triggers a WARN in

__disarm_kprobe_ftrace() and may even cause use-after-free:

Failed to disarm kprobe-ftrace at kernel_clone+0x0/0x3c0 (error -2)

WARNING: CPU: 5 PID: 137 at kernel/kprobes.c:1135 __disarm_kprobe_ftrace.isra.21+0xcf/0xe0

Modules linked in: testKprobe_007(-)

CPU: 5 PID: 137 Comm: rmmod Not tainted 6.1.0-rc4-dirty #18

[...]

Call Trace:

<TASK>

__disable_kprobe+0xcd/0xe0

__unregister_kprobe_top+0x12/0x150

? mutex_lock+0xe/0x3

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References