CVE-2022-49977

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead

ftrace_startup does not remove ops from ftrace_ops_list when

ftrace_startup_enable fails:

register_ftrace_function

ftrace_startup

__register_ftrace_function

...

add_ftrace_ops(&ftrace_ops_list, ops)

...

...

ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1

...

return 0 // ops is in the ftrace_ops_list.

When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything:

unregister_ftrace_function

ftrace_shutdown

if (unlikely(ftrace_disabled))

return -ENODEV; // return here, __unregister_ftrace_function is not executed,

// as a result, ops is still in the ftrace_ops_list

__unregister_ftrace_function

...

If ops is dynamically allocated, it will be free later, in this case,

is_ftrace_trampoli

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References