In the Linux kernel, the following vulnerability has been resolved:
tick/nohz: unexport _init-annotated ticknohzfullsetup()
EXPORTSYMBOL and _init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic.
modpost used to detect it, but it had been broken for a decade.
Commit 28438794aba4 ("modpost: fix section mismatch check for exported init/exit sections") fixed it so modpost started to warn it again, then this showed up:
MODPOST vmlinux.symvers
WARNING: modpost: vmlinux.o(_ksymtabgpl+ticknohzfullsetup+0x0): Section mismatch in reference from the variable _ksymtabticknohzfullsetup to the function .init.text:ticknohzfullsetup() The symbol ticknohzfullsetup is exported and annotated _init Fix this by removing the _init annotation of ticknohzfullsetup or drop the export.
Drop the export because ticknohzfull_setup() is only called from the built-in code in kernel/sched/isolation.c.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4a80ec8c51d68be4b7a7830c510f75080c5e417",
"id": "CVE-2022-49675-2dbb06cd",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/time/tick-sched.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"150219864163078679381287441689422238492",
"284822845530155802915126366857785313996",
"55513947299770652028840932164627298028",
"23042441453790954885808161339870825792"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4ff3ffe0138234774602152fe67e3a898c615c6",
"id": "CVE-2022-49675-94e6fab5",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/time/tick-sched.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"150219864163078679381287441689422238492",
"284822845530155802915126366857785313996",
"55513947299770652028840932164627298028",
"23042441453790954885808161339870825792"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2390095113e98fc52fffe35c5206d30d9efe3f78",
"id": "CVE-2022-49675-d6ea4dcd",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/time/tick-sched.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"150219864163078679381287441689422238492",
"284822845530155802915126366857785313996",
"55513947299770652028840932164627298028",
"23042441453790954885808161339870825792"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea32b27e2f8c58c92bff5ecba7fcf64b97707089",
"id": "CVE-2022-49675-d8c98560",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "kernel/time/tick-sched.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"150219864163078679381287441689422238492",
"284822845530155802915126366857785313996",
"55513947299770652028840932164627298028",
"23042441453790954885808161339870825792"
]
}
}
]