CVE-2022-49892

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Fix use-after-free for dynamic ftrace_ops

KASAN reported a use-after-free with ftrace ops [1]. It was found from

vmcore that perf had registered two ops with the same content

successively, both dynamic. After unregistering the second ops, a

use-after-free occurred.

In ftrace_shutdown(), when the second ops is unregistered, the

FTRACE_UPDATE_CALLS command is not set because there is another enabled

ops with the same content. Also, both ops are dynamic and the ftrace

callback function is ftrace_ops_list_func, so the

FTRACE_UPDATE_TRACE_FUNC command will not be set. Eventually the value

of 'command' will be 0 and ftrace_shutdown() will skip the rcu

synchronization.

However, ftrace may be activated. When the ops is released, another CPU

may be accessing the ops. Add the missing synchronization to fix this

problem.

[1]

BUG: KASAN: use-after-free in __ftrace_ops_list_func kernel/trace/ftrace.c:7020 [inline]

BU

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References