In the Linux kernel, the following vulnerability has been resolved:
driver core: Fix a potential null-ptr-deref in moduleadddriver()
Inject fault while probing of-fpga-region, if kasprintf() fails in moduleadddriver(), the second sysfsremovelink() in exit path will cause null-ptr-deref as below because kernfsnamehash() will call strlen() with NULL driver_name.
Fix it by releasing resources based on the exit path sequence.
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Mem abort info:
ESR = 0x0000000096000005
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x05: level 1 translation fault
Data abort info:
ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[dfffffc000000000] address between user and kernel address ranges
Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in: of_fpga_region(+) fpga_region fpga_bridge cfg80211 rfkill 8021q garp mrp stp llc ipv6 [last unloaded: of_fpga_region]
CPU: 2 UID: 0 PID: 2036 Comm: modprobe Not tainted 6.11.0-rc2-g6a0e38264012 #295
Hardware name: linux,dummy-virt (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : strlen+0x24/0xb0
lr : kernfs_name_hash+0x1c/0xc4
sp : ffffffc081f97380
x29: ffffffc081f97380 x28: ffffffc081f97b90 x27: ffffff80c821c2a0
x26: ffffffedac0be418 x25: 0000000000000000 x24: ffffff80c09d2000
x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000
x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000001840
x17: 0000000000000000 x16: 0000000000000000 x15: 1ffffff8103f2e42
x14: 00000000f1f1f1f1 x13: 0000000000000004 x12: ffffffb01812d61d
x11: 1ffffff01812d61c x10: ffffffb01812d61c x9 : dfffffc000000000
x8 : 0000004fe7ed29e4 x7 : ffffff80c096b0e7 x6 : 0000000000000001
x5 : ffffff80c096b0e0 x4 : 1ffffffdb990efa2 x3 : 0000000000000000
x2 : 0000000000000000 x1 : dfffffc000000000 x0 : 0000000000000000
Call trace:
strlen+0x24/0xb0
kernfs_name_hash+0x1c/0xc4
kernfs_find_ns+0x118/0x2e8
kernfs_remove_by_name_ns+0x80/0x100
sysfs_remove_link+0x74/0xa8
module_add_driver+0x278/0x394
bus_add_driver+0x1f0/0x43c
driver_register+0xf4/0x3c0
__platform_driver_register+0x60/0x88
of_fpga_region_init+0x20/0x1000 [of_fpga_region]
do_one_initcall+0x110/0x788
do_init_module+0x1dc/0x5c8
load_module+0x3c38/0x4cac
init_module_from_file+0xd4/0x128
idempotent_init_module+0x2cc/0x528
__arm64_sys_finit_module+0xac/0x100
invoke_syscall+0x6c/0x258
el0_svc_common.constprop.0+0x160/0x22c
do_el0_svc+0x44/0x5c
el0_svc+0x48/0xb8
el0t_64_sync_handler+0x13c/0x158
el0t_64_sync+0x190/0x194
Code: f2fbffe1 a90157f4 12000802 aa0003f5 (38e16861)
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Oops: Fatal exception
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47688.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-47688.json"
[
{
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"302724590971053046793583606871239378019",
"100360899991751485112878658762788739500",
"16756195544534843068880139397174113077",
"230664939973396397131335289806545675534",
"251006282616420404976463508882862369201",
"27890310865952939432718236328184426808",
"108717255988316726373879248850056254262",
"88899228593881269905363469912034074944",
"120040136986329988414954812858537979528",
"232205630622791803653883533324811147573",
"50482238801446338691228084765527729424",
"73144143648402077616289313537395490294",
"68781328239670381326493977796130676057",
"330923810015113216409076115425639200759",
"222420841666903269153987722207197726365",
"119268263970067962322783275336561915022",
"165522658631510108489811626088687045974",
"65849960734168292427565516379945719553",
"231995593478083226158662861098477045729"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/base/module.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b5d48b7a29cc6d508121a4b4e0c97a891e5273c",
"id": "CVE-2024-47688-06ab8102",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "250046194880258204240222559900916482751",
"length": 880.0
},
"signature_type": "Function",
"target": {
"file": "drivers/base/module.c",
"function": "module_add_driver"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8e45b910525704010d10c9dcbf2abf3005aa97c",
"id": "CVE-2024-47688-0c519f4a",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "250046194880258204240222559900916482751",
"length": 880.0
},
"signature_type": "Function",
"target": {
"file": "drivers/base/module.c",
"function": "module_add_driver"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4b5d48b7a29cc6d508121a4b4e0c97a891e5273c",
"id": "CVE-2024-47688-360e79a4",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"302724590971053046793583606871239378019",
"100360899991751485112878658762788739500",
"16756195544534843068880139397174113077",
"230664939973396397131335289806545675534",
"251006282616420404976463508882862369201",
"27890310865952939432718236328184426808",
"108717255988316726373879248850056254262",
"88899228593881269905363469912034074944",
"120040136986329988414954812858537979528",
"232205630622791803653883533324811147573",
"50482238801446338691228084765527729424",
"73144143648402077616289313537395490294",
"68781328239670381326493977796130676057",
"330923810015113216409076115425639200759",
"222420841666903269153987722207197726365",
"119268263970067962322783275336561915022",
"165522658631510108489811626088687045974",
"65849960734168292427565516379945719553",
"151562567067978511889976965085011224486"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/base/module.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcb9d581dee4c23f2378b6650511ece80dda4e2f",
"id": "CVE-2024-47688-4208b240",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"302724590971053046793583606871239378019",
"100360899991751485112878658762788739500",
"16756195544534843068880139397174113077",
"230664939973396397131335289806545675534",
"251006282616420404976463508882862369201",
"27890310865952939432718236328184426808",
"108717255988316726373879248850056254262",
"88899228593881269905363469912034074944",
"120040136986329988414954812858537979528",
"232205630622791803653883533324811147573",
"50482238801446338691228084765527729424",
"73144143648402077616289313537395490294",
"68781328239670381326493977796130676057",
"330923810015113216409076115425639200759",
"222420841666903269153987722207197726365",
"119268263970067962322783275336561915022",
"165522658631510108489811626088687045974",
"65849960734168292427565516379945719553",
"151562567067978511889976965085011224486"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/base/module.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18ec12c97b39ff6aa15beb8d2b25d15cd44b87d8",
"id": "CVE-2024-47688-6499a0f4",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "274562713190265933676029790795009962633",
"length": 886.0
},
"signature_type": "Function",
"target": {
"file": "drivers/base/module.c",
"function": "module_add_driver"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@18ec12c97b39ff6aa15beb8d2b25d15cd44b87d8",
"id": "CVE-2024-47688-8c74cab8",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"302724590971053046793583606871239378019",
"100360899991751485112878658762788739500",
"16756195544534843068880139397174113077",
"230664939973396397131335289806545675534",
"251006282616420404976463508882862369201",
"27890310865952939432718236328184426808",
"108717255988316726373879248850056254262",
"88899228593881269905363469912034074944",
"120040136986329988414954812858537979528",
"232205630622791803653883533324811147573",
"50482238801446338691228084765527729424",
"73144143648402077616289313537395490294",
"68781328239670381326493977796130676057",
"330923810015113216409076115425639200759",
"222420841666903269153987722207197726365",
"119268263970067962322783275336561915022",
"165522658631510108489811626088687045974",
"65849960734168292427565516379945719553",
"231995593478083226158662861098477045729"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/base/module.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8e45b910525704010d10c9dcbf2abf3005aa97c",
"id": "CVE-2024-47688-abb282fd",
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"function_hash": "274562713190265933676029790795009962633",
"length": 886.0
},
"signature_type": "Function",
"target": {
"file": "drivers/base/module.c",
"function": "module_add_driver"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcb9d581dee4c23f2378b6650511ece80dda4e2f",
"id": "CVE-2024-47688-ddf3c2eb",
"signature_version": "v1"
}
]