In the Linux kernel, the following vulnerability has been resolved:
kprobes: Protect kprobe_blacklist with RCU
__within_kprobe_blacklist() traverses kprobe_blacklist without holding
kprobe_mutex. When a module is unloaded, kprobe_remove_area_blacklist()
removes blacklist entries and immediately frees them with kfree().
A concurrent call to within_kprobe_blacklist() can therefore dereference
freed memory.
Furthermore, within_kprobe_blacklist() can be called in atomic or
non-preemptible contexts where the sleeping kprobe_mutex cannot be taken.
Protect kprobe_blacklist with RCU. Use guard(rcu)() and
list_for_each_entry_rcu() for traversal, list_add_tail_rcu() for
insertions, list_del_rcu() for deletions, and kfree_rcu() to reclaim
entries safely after a grace period.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8
AV:L - The UAF is reached only via local syscalls: x86 perf_event_open() hardware execute breakpoints and register_kprobe() (tracefs, perf kprobes, BPF). It is not invoked from network packet processing or a remote service.
AC:L - An attacker can loop the blacklist walk while concurrently causing module COMING/GOING so kprobe_remove_area_blacklist() does list_del/kfree, creating both sides of the race. Attacker-driven use-after-free races are AC:L.
PR:L - x86 hw_breakpoint_arch_parse() calls within_kprobe_blacklist() for kernel execute breakpoints during perf_event_open() before hw_breakpoint_parse()'s CAP_SYS_ADMIN check, so an unprivileged user can trigger the walk. Module autoload via request_module() can mutate the list without CAP_SYS_MODULE.
UI:N - The attacker triggers the race with their own syscalls (perf_event_open and module autoload/unload). No separate victim action is required.
S:U - The bug is kernel-heap use-after-free in kprobes. Effects stay inside the kernel's security authority and do not cross a VM, IOMMU, or other boundary.
C:H - Concurrent walk versus kfree of struct kprobe_blacklist_entry is a heap use-after-free. Reclaiming the object yields an arbitrary kernel read primitive, so confidentiality impact is high.
I:H - A heap use-after-free on a list node is exploitable via heap spraying for an arbitrary write and control-flow hijack, so integrity impact is high.
A:H - Following the freed blacklist entry's next pointer or fields causes a kernel oops or panic, taking down the system.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The UAF is reached only via local syscalls: x86 perf_event_open() hardware execute breakpoints and register_kprobe() (tracefs, perf kprobes, BPF). It is not invoked from network packet processing or a remote service.
AC:L - An attacker can loop the blacklist walk while concurrently causing module COMING/GOING so kprobe_remove_area_blacklist() does list_del/kfree, creating both sides of the race. Attacker-driven use-after-free races are AC:L.
PR:L - x86 hw_breakpoint_arch_parse() calls within_kprobe_blacklist() for kernel execute breakpoints during perf_event_open() before hw_breakpoint_parse()'s CAP_SYS_ADMIN check, so an unprivileged user can trigger the walk. Module autoload via request_module() can mutate the list without CAP_SYS_MODULE.
UI:N - The attacker triggers the race with their own syscalls (perf_event_open and module autoload/unload). No separate victim action is required.
S:U - The bug is kernel-heap use-after-free in kprobes. Effects stay inside the kernel's security authority and do not cross a VM, IOMMU, or other boundary.
C:H - Concurrent walk versus kfree of struct kprobe_blacklist_entry is a heap use-after-free. Reclaiming the object yields an arbitrary kernel read primitive, so confidentiality impact is high.
I:H - A heap use-after-free on a list node is exploitable via heap spraying for an arbitrary write and control-flow hijack, so integrity impact is high.
A:H - Following the freed blacklist entry's next pointer or fields causes a kernel oops or panic, taking down the system.
CVSS 3.1