CVE-2024-41004

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Build event generation tests only as modules

The kprobes and synth event generation test modules add events and lock

(get a reference) those event file reference in module init function,

and unlock and delete it in module exit function. This is because those

are designed for playing as modules.

If we make those modules as built-in, those events are left locked in the

kernel, and never be removed. This causes kprobe event self-test failure

as below.

[ 97.349708] ------------[ cut here ]------------

[ 97.353453] WARNING: CPU: 3 PID: 1 at kernel/trace/trace_kprobe.c:2133 kprobe_trace_self_tests_init+0x3f1/0x480

[ 97.357106] Modules linked in:

[ 97.358488] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 6.9.0-g699646734ab5-dirty #14

[ 97.361556] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014

[ 97.363880] RIP: 0010:kprobe_trace_self_tests_init+0x3f1/0x480

[ 97.365538] Co

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References