Описание
In the Linux kernel, the following vulnerability has been resolved:
ftrace: Also allocate and copy hash for reading of filter files
Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds
the pointer to the global tracer hash to its iterator. Unlike the writer
that allocates a copy of the hash, the reader keeps the pointer to the
filter hashes. This is problematic because this pointer is static across
function calls that release the locks that can update the global tracer
hashes. This can cause UAF and similar bugs.
Allocate and copy the hash for reading the filter files like it is done
for the writers. This not only fixes UAF bugs, but also makes the code a
bit simpler as it doesn't have to differentiate when to free the
iterator's hash between writers and readers.
A flaw was found in the Linux kernel. A Use-After-Free (UAF) vulnerability exists in the ftrace subsystem during the reading of tracing filter files. The filter reader retains a direct pointer to global filter data rather than creating an independent copy, which allows concurrent updates to free the underlying memory while it is still referenced. A local attacker can exploit this flaw to cause a Denial of Service (DoS) through a system crash or potentially achieve privilege escalation.
Отчет
A use-after-free flaw was found in the Linux kernel's ftrace subsystem, rated by Red Hat as Moderate severity. It affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10 and the kernel package in Red Hat In-Vehicle OS 1. When reading the set_ftrace_filter or set_ftrace_notrace tracing files, the reader keeps a direct pointer to the global tracer hash instead of an allocated copy, so a concurrent update that releases the locks protecting the global tracer hashes can free the underlying memory while it is still referenced. A local attacker with the elevated privileges required to access the ftrace tracing files could exploit this use-after-free to cause a denial of service (system crash) or potentially escalate privileges. Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present in that stream. A fix for the affected streams is currently deferred, so the flaw remains unresolved in those products; the residual risk is limited because exploitation requires local access with elevated privileges to the tracing subsystem. Red Hat scored this flaw Moderate (CVSS 6.4) rather than the High severity (7.8) assigned by NIST and CVE.org because accessing the ftrace filter files requires elevated privileges, which significantly reduces the attack exposure.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.4 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy of the hash, the reader keeps the pointer to the filter hashes. This is problematic because this pointer is static across function calls that release the locks that can update the global tracer hashes. This can cause UAF and similar bugs. Allocate and copy the hash for reading the filter files like it is done for the writers. This not only fixes UAF bugs, but also makes the code a bit simpler as it doesn't have to differentiate when to free the iterator's hash between writers and readers.
In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy of the hash, the reader keeps the pointer to the filter hashes. This is problematic because this pointer is static across function calls that release the locks that can update the global tracer hashes. This can cause UAF and similar bugs. Allocate and copy the hash for reading the filter files like it is done for the writers. This not only fixes UAF bugs, but also makes the code a bit simpler as it doesn't have to differentiate when to free the iterator's hash between writers and readers.
ftrace: Also allocate and copy hash for reading of filter files
In the Linux kernel, the following vulnerability has been resolved: f ...
In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy of the hash, the reader keeps the pointer to the filter hashes. This is problematic because this pointer is static across function calls that release the locks that can update the global tracer hashes. This can cause UAF and similar bugs. Allocate and copy the hash for reading the filter files like it is done for the writers. This not only fixes UAF bugs, but also makes the code a bit simpler as it doesn't have to differentiate when to free the iterator's hash between writers and readers.
EPSS
6.4 Medium
CVSS3