CVE-2024-50194

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

arm64: probes: Fix uprobes for big-endian kernels

The arm64 uprobes code is broken for big-endian kernels as it doesn't

convert the in-memory instruction encoding (which is always

little-endian) into the kernel's native endianness before analyzing and

simulating instructions. This may result in a few distinct problems:

* The kernel may may erroneously reject probing an instruction which can

safely be probed.

* The kernel may erroneously erroneously permit stepping an

instruction out-of-line when that instruction cannot be stepped

out-of-line safely.

* The kernel may erroneously simulate instruction incorrectly dur to

interpretting the byte-swapped encoding.

The endianness mismatch isn't caught by the compiler or sparse because:

* The arch_uprobe::{insn,ixol} fields are encoded as arrays of u8, so

the compiler and sparse have no idea these contain a little-endian

32-bit value. The core uprobes code po

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References