cve-2022-49779
Vulnerability from cvelistv5
Published
2025-05-01 14:09
Modified
2025-05-04 08:45
Severity ?
EPSS score ?
Summary
kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case
References
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/kprobes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7b0007b28dd970176f2e297c06ae63eea2447127",
"status": "affected",
"version": "0bc11ed5ab60c135aa764a62c02cd5ea68289de4",
"versionType": "git"
},
{
"lessThan": "7d606ae1abcc3eab5408e42444d789dc7def51b8",
"status": "affected",
"version": "0bc11ed5ab60c135aa764a62c02cd5ea68289de4",
"versionType": "git"
},
{
"lessThan": "c49cc2c059b503e962c2f13a806c105f9b757df4",
"status": "affected",
"version": "0bc11ed5ab60c135aa764a62c02cd5ea68289de4",
"versionType": "git"
},
{
"lessThan": "55788ebbe8b365b4375bd56b4ba7db79d393a370",
"status": "affected",
"version": "0bc11ed5ab60c135aa764a62c02cd5ea68289de4",
"versionType": "git"
},
{
"lessThan": "5dd7caf0bdc5d0bae7cf9776b4d739fb09bd5ebb",
"status": "affected",
"version": "0bc11ed5ab60c135aa764a62c02cd5ea68289de4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/kprobes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.225",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.156",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.225",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.156",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.80",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.10",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkprobes: Skip clearing aggrprobe\u0027s post_handler in kprobe-on-ftrace case\n\nIn __unregister_kprobe_top(), if the currently unregistered probe has\npost_handler but other child probes of the aggrprobe do not have\npost_handler, the post_handler of the aggrprobe is cleared. If this is\na ftrace-based probe, there is a problem. In later calls to\ndisarm_kprobe(), we will use kprobe_ftrace_ops because post_handler is\nNULL. But we\u0027re armed with kprobe_ipmodify_ops. This triggers a WARN in\n__disarm_kprobe_ftrace() and may even cause use-after-free:\n\n Failed to disarm kprobe-ftrace at kernel_clone+0x0/0x3c0 (error -2)\n WARNING: CPU: 5 PID: 137 at kernel/kprobes.c:1135 __disarm_kprobe_ftrace.isra.21+0xcf/0xe0\n Modules linked in: testKprobe_007(-)\n CPU: 5 PID: 137 Comm: rmmod Not tainted 6.1.0-rc4-dirty #18\n [...]\n Call Trace:\n \u003cTASK\u003e\n __disable_kprobe+0xcd/0xe0\n __unregister_kprobe_top+0x12/0x150\n ? mutex_lock+0xe/0x30\n unregister_kprobes.part.23+0x31/0xa0\n unregister_kprobe+0x32/0x40\n __x64_sys_delete_module+0x15e/0x260\n ? do_user_addr_fault+0x2cd/0x6b0\n do_syscall_64+0x3a/0x90\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n [...]\n\nFor the kprobe-on-ftrace case, we keep the post_handler setting to\nidentify this aggrprobe armed with kprobe_ipmodify_ops. This way we\ncan disarm it correctly."
}
],
"providerMetadata": {
"dateUpdated": "2025-05-04T08:45:12.098Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7b0007b28dd970176f2e297c06ae63eea2447127"
},
{
"url": "https://git.kernel.org/stable/c/7d606ae1abcc3eab5408e42444d789dc7def51b8"
},
{
"url": "https://git.kernel.org/stable/c/c49cc2c059b503e962c2f13a806c105f9b757df4"
},
{
"url": "https://git.kernel.org/stable/c/55788ebbe8b365b4375bd56b4ba7db79d393a370"
},
{
"url": "https://git.kernel.org/stable/c/5dd7caf0bdc5d0bae7cf9776b4d739fb09bd5ebb"
}
],
"title": "kprobes: Skip clearing aggrprobe\u0027s post_handler in kprobe-on-ftrace case",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-49779",
"datePublished": "2025-05-01T14:09:14.445Z",
"dateReserved": "2025-04-16T07:17:33.806Z",
"dateUpdated": "2025-05-04T08:45:12.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2022-49779\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-01T15:16:01.080\",\"lastModified\":\"2025-05-02T13:53:20.943\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nkprobes: Skip clearing aggrprobe\u0027s post_handler in kprobe-on-ftrace case\\n\\nIn __unregister_kprobe_top(), if the currently unregistered probe has\\npost_handler but other child probes of the aggrprobe do not have\\npost_handler, the post_handler of the aggrprobe is cleared. If this is\\na ftrace-based probe, there is a problem. In later calls to\\ndisarm_kprobe(), we will use kprobe_ftrace_ops because post_handler is\\nNULL. But we\u0027re armed with kprobe_ipmodify_ops. This triggers a WARN in\\n__disarm_kprobe_ftrace() and may even cause use-after-free:\\n\\n Failed to disarm kprobe-ftrace at kernel_clone+0x0/0x3c0 (error -2)\\n WARNING: CPU: 5 PID: 137 at kernel/kprobes.c:1135 __disarm_kprobe_ftrace.isra.21+0xcf/0xe0\\n Modules linked in: testKprobe_007(-)\\n CPU: 5 PID: 137 Comm: rmmod Not tainted 6.1.0-rc4-dirty #18\\n [...]\\n Call Trace:\\n \u003cTASK\u003e\\n __disable_kprobe+0xcd/0xe0\\n __unregister_kprobe_top+0x12/0x150\\n ? mutex_lock+0xe/0x30\\n unregister_kprobes.part.23+0x31/0xa0\\n unregister_kprobe+0x32/0x40\\n __x64_sys_delete_module+0x15e/0x260\\n ? do_user_addr_fault+0x2cd/0x6b0\\n do_syscall_64+0x3a/0x90\\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n [...]\\n\\nFor the kprobe-on-ftrace case, we keep the post_handler setting to\\nidentify this aggrprobe armed with kprobe_ipmodify_ops. This way we\\ncan disarm it correctly.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: kprobes: Omitir la limpieza del post_handler de aggrprobe en el caso de kprobe-on-ftrace. En __unregister_kprobe_top(), si la sonda actualmente no registrada tiene post_handler, pero otras sondas secundarias de aggrprobe no lo tienen, se limpia el post_handler de aggrprobe. Si se trata de una sonda basada en ftrace, existe un problema. En llamadas posteriores a disarm_kprobe(), usaremos kprobe_ftrace_ops porque post_handler es NULL. Pero estamos preparados con kprobe_ipmodify_ops. Esto activa una ADVERTENCIA en __disarm_kprobe_ftrace() e incluso puede provocar un use-after-free: No se pudo desarmar kprobe-ftrace en kernel_clone+0x0/0x3c0 (error -2) ADVERTENCIA: CPU: 5 PID: 137 en kernel/kprobes.c:1135 __disarm_kprobe_ftrace.isra.21+0xcf/0xe0 M\u00f3dulos vinculados en: testKprobe_007(-) CPU: 5 PID: 137 Comm: rmmod No contaminado 6.1.0-rc4-dirty #18 [...] Seguimiento de llamadas: __disable_kprobe+0xcd/0xe0 __unregister_kprobe_top+0x12/0x150 ? mutex_lock+0xe/0x30 unregister_kprobes.part.23+0x31/0xa0 unregister_kprobe+0x32/0x40 __x64_sys_delete_module+0x15e/0x260 ? do_user_addr_fault+0x2cd/0x6b0 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] For the kprobe-on-ftrace case, we keep the post_handler setting to identify this aggrprobe armed with kprobe_ipmodify_ops. De esta forma, podemos desactivarla correctamente.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/55788ebbe8b365b4375bd56b4ba7db79d393a370\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5dd7caf0bdc5d0bae7cf9776b4d739fb09bd5ebb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7b0007b28dd970176f2e297c06ae63eea2447127\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7d606ae1abcc3eab5408e42444d789dc7def51b8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c49cc2c059b503e962c2f13a806c105f9b757df4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.