CVE-2022-49236

published 2025-02-26

CVE-2022-49236: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to race between btf_try_get_module and load_module While working on code…

Priority P3 40 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix UAF due to race between btf_try_get_module and load_module

While working on code to populate kfunc BTF ID sets for module BTF from
its initcall, I noticed that by the time the initcall is invoked, the
module BTF can already be seen by userspace (and the BPF verifier). The
existing btf_try_get_module calls try_module_get which only fails if
mod->state == MODULE_STATE_GOING, i.e. it can increment module reference
when module initcall is happening in parallel.

Currently, BTF parsing happens from MODULE_STATE_COMING notifier
callback. At this point, the module initcalls have not been invoked.
The notifier callback parses and prepares the module BTF, allocates an
ID, which publishes it to userspace, and then adds it to the btf_modules
list allowing the kernel to invoke btf_try_get_module for the BTF.

However, at this point, the module has not been fully initialized (i.e.
its initcalls have not finished). The code in module.c can still fail
and free the module, without caring for other users. However, nothing
stops btf_try_get_module from succeeding between the state transition
from MODULE_STATE_COMING to MODULE_STATE_LIVE.

This leads to a use-after-free issue when BPF program loads
successfully in the state transition, load_module's do_init_module call
fails and frees the module, and BPF program fd on close calls module_put
for the freed module. Future patch has test case to verify we don't
regress in this area in future.

There are multiple points after prepare_coming_module (in load_module)
where failure can occur and module loading can return error. We
illustrate and test for the race using the last point where it can
practically occur (in module __init function).

An illustration of the race:

CPU 0 CPU 1
load_module
notifier_call(MODULE_STATE_COMING)
btf_parse_module
btf_alloc_id // Published to userspace
list_add(&btf_mod->list, btf_modules)
mod->init(...)
... ^
bpf_check |
check_pseu

Affected

12 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.17.3-1 (bookworm)	linux 5.17.3-1 (bookworm)
linux	linux	—	—
linux	linux	>= 541c3bad8dc51b253ba8686d0cd7628e6b9b5f4c < 51b82141fffa454abf937a8ff0b8af89e4fd0c8f	51b82141fffa454abf937a8ff0b8af89e4fd0c8f
linux	linux	>= 541c3bad8dc51b253ba8686d0cd7628e6b9b5f4c < d7fccf264b1a785525b366a5b7f8113c756187ad	d7fccf264b1a785525b366a5b7f8113c756187ad
linux	linux	>= 541c3bad8dc51b253ba8686d0cd7628e6b9b5f4c < 0481baa2318cb1ab13277715da6cdbb657807b3f	0481baa2318cb1ab13277715da6cdbb657807b3f
linux	linux	>= 541c3bad8dc51b253ba8686d0cd7628e6b9b5f4c < 18688de203b47e5d8d9d0953385bf30b5949324f	18688de203b47e5d8d9d0953385bf30b5949324f
linux	linux_kernel	>= 0 < 5.17.3-1	5.17.3-1
linux	linux_kernel	>= 0 < 5.17.3-1	5.17.3-1
linux	linux_kernel	>= 0 < 5.17.3-1	5.17.3-1
linux	linux_kernel	>= 5.12 < 5.15.33	5.15.33
linux	linux_kernel	>= 5.16 < 5.16.19	5.16.19
linux	linux_kernel	>= 5.17 < 5.17.2	5.17.2

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

osv 7.8 HIGH

vendor_debian 7.8 HIGH

vendor_redhat 7.8 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-416