In the Linux kernel, the following vulnerability has been resolved:
ftrace: Fix invalid address access in lookup_rec() when index is 0
KASAN reported follow problem:
BUG: KASAN: use-after-free in lookuprec Read of size 8 at addr ffff000199270ff0 by task modprobe CPU: 2 Comm: modprobe Call trace: kasanreport _asanload8 lookuprec ftracelocation archcheckftracelocation checkkprobeaddresssafe register_kprobe
When checking pg->records[pg->index - 1].ip in lookuprec(), it can get a pg which is newly added to ftracepagesstart in ftraceprocess_locs(). Before the first pg->index++, index is 0 and accessing pg->records[-1].ip will cause this problem.
Don't check the ip when pg->index is 0.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a0d71fabfeb349216d33f001a6421b1768bd3a9",
"target": {
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53075-0d4c6737",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"78157565101487502395511136155649912546",
"34644351602053526257273455253423115009",
"179945799333506908285943640003217894553",
"247533972434393757130328313073771384249"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac58b88ccbbb8e9fb83e137cee04a856b1ea6635",
"target": {
"function": "ftrace_location_range",
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53075-207c7bdb",
"signature_type": "Function",
"digest": {
"length": 484.0,
"function_hash": "105915494703084500049743507461729967869"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7569ee04b0e3b32df79f64db3a7138573edad9bc",
"target": {
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53075-255b270e",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"78157565101487502395511136155649912546",
"34644351602053526257273455253423115009",
"179945799333506908285943640003217894553",
"247533972434393757130328313073771384249"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@83c3b2f4e7c61367c7b24551f4c6eb94bbdda283",
"target": {
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53075-36763e87",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"78157565101487502395511136155649912546",
"34644351602053526257273455253423115009",
"179945799333506908285943640003217894553",
"247533972434393757130328313073771384249"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f84f31f63416b0f02fc146ffdc4ab32723eb7e8",
"target": {
"function": "lookup_rec",
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53075-38e58df5",
"signature_type": "Function",
"digest": {
"length": 482.0,
"function_hash": "320848995986028257671342822813989021207"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7569ee04b0e3b32df79f64db3a7138573edad9bc",
"target": {
"function": "ftrace_location_range",
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53075-6c86099c",
"signature_type": "Function",
"digest": {
"length": 484.0,
"function_hash": "105915494703084500049743507461729967869"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2de28e5ce34b22b73b833a21e2c45ae3aade3964",
"target": {
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53075-90c9966c",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"78157565101487502395511136155649912546",
"34644351602053526257273455253423115009",
"179945799333506908285943640003217894553",
"247533972434393757130328313073771384249"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2de28e5ce34b22b73b833a21e2c45ae3aade3964",
"target": {
"function": "ftrace_location_range",
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53075-9e8248a8",
"signature_type": "Function",
"digest": {
"length": 484.0,
"function_hash": "105915494703084500049743507461729967869"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac58b88ccbbb8e9fb83e137cee04a856b1ea6635",
"target": {
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53075-a74b3b38",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"78157565101487502395511136155649912546",
"34644351602053526257273455253423115009",
"179945799333506908285943640003217894553",
"247533972434393757130328313073771384249"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@83c3b2f4e7c61367c7b24551f4c6eb94bbdda283",
"target": {
"function": "lookup_rec",
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53075-abfbfea3",
"signature_type": "Function",
"digest": {
"length": 482.0,
"function_hash": "320848995986028257671342822813989021207"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1bd8b7fd890d87d0dc4dedc6287ea34dd07c0b4",
"target": {
"function": "lookup_rec",
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53075-bcc1136e",
"signature_type": "Function",
"digest": {
"length": 482.0,
"function_hash": "320848995986028257671342822813989021207"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee92fa443358f4fc0017c1d0d325c27b37802504",
"target": {
"function": "lookup_rec",
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53075-befbe556",
"signature_type": "Function",
"digest": {
"length": 482.0,
"function_hash": "320848995986028257671342822813989021207"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a0d71fabfeb349216d33f001a6421b1768bd3a9",
"target": {
"function": "lookup_rec",
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53075-c4f31476",
"signature_type": "Function",
"digest": {
"length": 482.0,
"function_hash": "320848995986028257671342822813989021207"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee92fa443358f4fc0017c1d0d325c27b37802504",
"target": {
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53075-cdd40b02",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"78157565101487502395511136155649912546",
"34644351602053526257273455253423115009",
"179945799333506908285943640003217894553",
"247533972434393757130328313073771384249"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f84f31f63416b0f02fc146ffdc4ab32723eb7e8",
"target": {
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53075-e7a18e81",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"78157565101487502395511136155649912546",
"34644351602053526257273455253423115009",
"179945799333506908285943640003217894553",
"247533972434393757130328313073771384249"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1bd8b7fd890d87d0dc4dedc6287ea34dd07c0b4",
"target": {
"file": "kernel/trace/ftrace.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-53075-ead3ae6d",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"78157565101487502395511136155649912546",
"34644351602053526257273455253423115009",
"179945799333506908285943640003217894553",
"247533972434393757130328313073771384249"
]
}
}
]