CVE-2024-35955

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> kprobes: Fix possible use-after-free issue on kprobe registration<br /> <br /> When unloading a module, its state is changing MODULE_STATE_LIVE -&gt;<br /> MODULE_STATE_GOING -&gt; MODULE_STATE_UNFORMED. Each change will take<br /> a time. `is_module_text_address()` and `__module_text_address()`<br /> works with MODULE_STATE_LIVE and MODULE_STATE_GOING.<br /> If we use `is_module_text_address()` and `__module_text_address()`<br /> separately, there is a chance that the first one is succeeded but the<br /> next one is failed because module-&gt;state becomes MODULE_STATE_UNFORMED<br /> between those operations.<br /> <br /> In `check_kprobe_address_safe()`, if the second `__module_text_address()`<br /> is failed, that is ignored because it expected a kernel_text address.<br /> But it may have failed simply because module-&gt;state has been changed<br /> to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify<br /> non-exist module text address (use-after-free).<br /> <br /> To fix this problem, we should not use separated `is_module_text_address()`<br /> and `__module_text_address()`, but use only `__module_text_address()`<br /> once and do `try_module_get(module)` which is only available with<br /> MODULE_STATE_LIVE.