CVE-2022-49721

published 2025-02-26

CVE-2022-49721: In the Linux kernel, the following vulnerability has been resolved: arm64: ftrace: consistently handle PLTs. Sometimes it is necessary to use a PLT entry to…

Priority P4 21 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

arm64: ftrace: consistently handle PLTs.

Sometimes it is necessary to use a PLT entry to call an ftrace
trampoline. This is handled by ftrace_make_call() and ftrace_make_nop(),
with each having *almost* identical logic, but this is not handled by
ftrace_modify_call() since its introduction in commit:

3b23e4991fb66f6d ("arm64: implement ftrace with regs")

Due to this, if we ever were to call ftrace_modify_call() for a callsite
which requires a PLT entry for a trampoline, then either:

a) If the old addr requires a trampoline, ftrace_modify_call() will use
an out-of-range address to generate the 'old' branch instruction.
This will result in warnings from aarch64_insn_gen_branch_imm() and
ftrace_modify_code(), and no instructions will be modified. As
ftrace_modify_call() will return an error, this will result in
subsequent internal ftrace errors.

b) If the old addr does not require a trampoline, but the new addr does,
ftrace_modify_call() will use an out-of-range address to generate the
'new' branch instruction. This will result in warnings from
aarch64_insn_gen_branch_imm(), and ftrace_modify_code() will replace
the 'old' branch with a BRK. This will result in a kernel panic when
this BRK is later executed.

Practically speaking, case (a) is vastly more likely than case (b), and
typically this will result in internal ftrace errors that don't
necessarily affect the rest of the system. This can be demonstrated with
an out-of-tree test module which triggers ftrace_modify_call(), e.g.

| # insmod test_ftrace.ko
| test_ftrace: Function test_function raw=0xffffb3749399201c, callsite=0xffffb37493992024
| branch_imm_common: offset out of range
| branch_imm_common: offset out of range
| ------------[ ftrace bug ]------------
| ftrace failed to modify
| [] test_function+0x8/0x38 [test_ftrace]
| actual: 1d:00:00:94
| Updating ftrace call site to call a different ftrace function
| ftrace record flags: e00000

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.18.14-1 (bookworm)	linux 5.18.14-1 (bookworm)
linux	linux	—	—
linux	linux	>= 3b23e4991fb66f6d152f9055ede271a726ef9f21 < bc28fde90937a920f7714ec4408269cac744f796	bc28fde90937a920f7714ec4408269cac744f796
linux	linux	>= 3b23e4991fb66f6d152f9055ede271a726ef9f21 < db73aa9466338ec821ed2a0b01721fe4d06876b1	db73aa9466338ec821ed2a0b01721fe4d06876b1
linux	linux	>= 3b23e4991fb66f6d152f9055ede271a726ef9f21 < dcecc96ed16f73417de5550f384e348c9d56f279	dcecc96ed16f73417de5550f384e348c9d56f279
linux	linux	>= 3b23e4991fb66f6d152f9055ede271a726ef9f21 < a6253579977e4c6f7818eeb05bf2bc65678a7187	a6253579977e4c6f7818eeb05bf2bc65678a7187
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.127-1	5.10.127-1
linux	linux_kernel	>= 0 < 5.18.14-1	5.18.14-1
linux	linux_kernel	>= 0 < 5.18.14-1	5.18.14-1
linux	linux_kernel	>= 0 < 5.18.14-1	5.18.14-1
linux	linux_kernel	>= 5.11 < 5.15.49	5.15.49
linux	linux_kernel	>= 5.16 < 5.18.6	5.18.6
linux	linux_kernel	>= 5.5 < 5.10.124	5.10.124

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.