CVE-2023-53557

general protection fault, probably for non-canonical address \ 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUGPAGEALLOC NOPTI ... Call Trace: <TASK> fprobehandler+0xc1/0x270 ? _pfxbpftestmodinit+0x10/0x10 ? _pfxbpftestmodinit+0x10/0x10 ? bpffentrytest1+0x5/0x10 ? bpffentrytest1+0x5/0x10 ? bpftestmodinit+0x22/0x80 ? dooneinitcall+0x63/0x2e0 ? rcuiswatching+0xd/0x40 ? kmalloctrace+0xaf/0xc0 ? doinitmodule+0x60/0x250 ? _dosysfinitmodule+0xac/0x120 ? dosyscall64+0x37/0x90 ? entrySYSCALL64after_hwframe+0x72/0xdc </TASK>

In unregister_fprobe function we can't release fp->rethook while it's possible there are some of its users still running on another cpu.

Moving rethookfree call after fp->ops is unregistered with unregisterftrace_function call.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53557.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5b0ab78998e32564a011b14c4c7f9c81e2d42b9d

Fixed

ce3ec57faff559ccae1e0150c1f077eb2df648a4

Fixed

03d63255a5783243c110aec5e6ae2f1475c3be76

Fixed

5f81018753dfd4989e33ece1f0cb6b8aae498b82

Affected versions

v5.*

v5.17

v5.17-rc7

v5.17-rc8

v5.18

v5.18-rc1

v5.18-rc2

v5.18-rc3

v5.18-rc4

v5.18-rc5

v5.18-rc6

v5.18-rc7

v5.19

v5.19-rc1

v5.19-rc2

v5.19-rc3

v5.19-rc4

v5.19-rc5

v5.19-rc6

v5.19-rc7

v5.19-rc8

v6.*

v6.0

v6.0-rc1

v6.0-rc2

v6.0-rc3

v6.0-rc4

v6.0-rc5

v6.0-rc6

v6.0-rc7

v6.1

v6.1-rc1

v6.1-rc2

v6.1-rc3

v6.1-rc4

v6.1-rc5

v6.1-rc6

v6.1-rc7

v6.1-rc8

v6.1.1

v6.1.10

v6.1.11

v6.1.12

v6.1.13

v6.1.14

v6.1.15

v6.1.16

v6.1.17

v6.1.18

v6.1.19

v6.1.2

v6.1.20

v6.1.21

v6.1.22

v6.1.23

v6.1.24

v6.1.25

v6.1.26

v6.1.27

v6.1.28

v6.1.29

v6.1.3

v6.1.30

v6.1.31

v6.1.32

v6.1.33

v6.1.34

v6.1.35

v6.1.36

v6.1.37

v6.1.38

v6.1.39

v6.1.4

v6.1.5

v6.1.6

v6.1.7

v6.1.8

v6.1.9

v6.2

v6.2-rc1

v6.2-rc2

v6.2-rc3

v6.2-rc4

v6.2-rc5

v6.2-rc6

v6.2-rc7

v6.2-rc8

v6.3

v6.3-rc1

v6.3-rc2

v6.3-rc3

v6.3-rc4

v6.3-rc5

v6.3-rc6

v6.3-rc7

v6.4

v6.4-rc1

v6.4-rc2

v6.4-rc3

v6.4-rc4

v6.4-rc5

v6.4-rc6

v6.4-rc7

v6.4.1

v6.4.2

v6.4.3

v6.4.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53557.json"

vanir_signatures

[
    {
        "id": "CVE-2023-53557-0e40989c",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "82433351881605059411186050835962386741",
                "174955064389901974308887417975058901325",
                "324377533475986597995487606569653591253",
                "225973419336816777316397498031543016478",
                "236822684300451653238470985030659009496",
                "136447884263480709274439156174729366906",
                "109824767866655837100506802195835599171",
                "157344759536209071604308601990594092499"
            ]
        },
        "signature_type": "Line",
        "target": {
            "file": "kernel/trace/fprobe.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f81018753dfd4989e33ece1f0cb6b8aae498b82",
        "deprecated": false
    },
    {
        "id": "CVE-2023-53557-154d9159",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "82433351881605059411186050835962386741",
                "174955064389901974308887417975058901325",
                "324377533475986597995487606569653591253",
                "225973419336816777316397498031543016478",
                "236822684300451653238470985030659009496",
                "136447884263480709274439156174729366906",
                "109824767866655837100506802195835599171",
                "157344759536209071604308601990594092499"
            ]
        },
        "signature_type": "Line",
        "target": {
            "file": "kernel/trace/fprobe.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce3ec57faff559ccae1e0150c1f077eb2df648a4",
        "deprecated": false
    },
    {
        "id": "CVE-2023-53557-225cec48",
        "digest": {
            "length": 349.0,
            "function_hash": "201415203064687039863131191220211604362"
        },
        "signature_type": "Function",
        "target": {
            "file": "kernel/trace/fprobe.c",
            "function": "unregister_fprobe"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03d63255a5783243c110aec5e6ae2f1475c3be76",
        "deprecated": false
    },
    {
        "id": "CVE-2023-53557-3ccfb4a9",
        "digest": {
            "length": 349.0,
            "function_hash": "201415203064687039863131191220211604362"
        },
        "signature_type": "Function",
        "target": {
            "file": "kernel/trace/fprobe.c",
            "function": "unregister_fprobe"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce3ec57faff559ccae1e0150c1f077eb2df648a4",
        "deprecated": false
    },
    {
        "id": "CVE-2023-53557-9aadf5e0",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "82433351881605059411186050835962386741",
                "174955064389901974308887417975058901325",
                "324377533475986597995487606569653591253",
                "225973419336816777316397498031543016478",
                "236822684300451653238470985030659009496",
                "136447884263480709274439156174729366906",
                "109824767866655837100506802195835599171",
                "157344759536209071604308601990594092499"
            ]
        },
        "signature_type": "Line",
        "target": {
            "file": "kernel/trace/fprobe.c"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03d63255a5783243c110aec5e6ae2f1475c3be76",
        "deprecated": false
    },
    {
        "id": "CVE-2023-53557-db39ccc5",
        "digest": {
            "length": 349.0,
            "function_hash": "201415203064687039863131191220211604362"
        },
        "signature_type": "Function",
        "target": {
            "file": "kernel/trace/fprobe.c",
            "function": "unregister_fprobe"
        },
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f81018753dfd4989e33ece1f0cb6b8aae498b82",
        "deprecated": false
    }
]

Git / github.com/gregkh/linux