In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix use-after-free in bpfuprobemultilinkattach()
If bpflinkprime() fails, bpfuprobemultilinkattach() goes to the errorfree label and frees the array of bpfuprobe's without calling bpfuprobeunregister().
This leaks bpfuprobe->uprobe and worse, this frees bpfuprobe->consumer without removing it from the uprobe->consumers list.
{ "vanir_signatures": [ { "signature_version": "v1", "signature_type": "Line", "target": { "file": "kernel/trace/bpf_trace.c" }, "id": "CVE-2024-47675-bbb82b81", "digest": { "line_hashes": [ "232199977138761564168210356081594199480", "101323648324336881436773907868666273690", "4967378215155633796116851223972606131", "278620120578700354659069744431450035357", "158774310169381428248402635715860720586", "277014516990592047080037467496325750929", "101475221164334993028755123171615563407", "141945848821265755988191446249006564694", "12265625284228822904932384632656278727", "34261639046523092821786229302155258623", "101982025419750827815246399955645663173" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdf27834c3dd5d9abf7eb8e4ee87ee9e307eb25c" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "kernel/trace/bpf_trace.c", "function": "bpf_uprobe_multi_link_attach" }, "id": "CVE-2024-47675-dc5adbcf", "digest": { "length": 2928.0, "function_hash": "305502381869536576462371819984786308019" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdf27834c3dd5d9abf7eb8e4ee87ee9e307eb25c" } ] }