CVE-2022-49977
published 2025-06-18CVE-2022-49977: In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.22%
12.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
ftrace_startup does not remove ops from ftrace_ops_list when
ftrace_startup_enable fails:
register_ftrace_function
ftrace_startup
__register_ftrace_function
...
add_ftrace_ops(&ftrace_ops_list, ops)
...
...
ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1
...
return 0 // ops is in the ftrace_ops_list.
When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything:
unregister_ftrace_function
ftrace_shutdown
if (unlikely(ftrace_disabled))
return -ENODEV; // return here, __unregister_ftrace_function is not executed,
// as a result, ops is still in the ftrace_ops_list
__unregister_ftrace_function
...
If ops is dynamically allocated, it will be free later, in this case,
is_ftrace_trampoline accesses NULL pointer:
is_ftrace_trampoline
ftrace_ops_trampoline
do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL!
Syzkaller reports as follows:
[ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b
[ 1203.508039] #PF: supervisor read access in kernel mode
[ 1203.508798] #PF: error_code(0x0000) - not-present page
[ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0
[ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI
[ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G B W 5.10.0 #8
[ 1203.512324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0
[ 1203.514644] Code: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00
[ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246
[ 1203.520092] RAX: 0000000000000000 RBX: 000000000000007b RCX: ffffffff8
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 3.10.22 < 3.11 | 3.11 |
| linux | linux | >= 3.12.3 < 3.13 | 3.13 |
| linux | linux | >= 3.2.54 < 3.3 | 3.3 |
| linux | linux | >= 3.4.72 < 3.5 | 3.5 |
| linux | linux | >= 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 < 8569b4ada1e0b9bfaa125bd0c0967918b6560fa2 | 8569b4ada1e0b9bfaa125bd0c0967918b6560fa2 |
| linux | linux | >= 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 < 4c34a2a6c9927c239dd2e295a03d49b37b618d2c | 4c34a2a6c9927c239dd2e295a03d49b37b618d2c |
| linux | linux | >= 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 < ddffe882d74ef43a3494f0ab0c24baf076c45f96 | ddffe882d74ef43a3494f0ab0c24baf076c45f96 |
| linux | linux | >= 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 < 934e49f7d696afdae9f979abe3f308408184e17b | 934e49f7d696afdae9f979abe3f308408184e17b |
| linux | linux | >= 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 < dbd8c8fc60480e3faa3ae7e27ebe03371ecd1b77 | dbd8c8fc60480e3faa3ae7e27ebe03371ecd1b77 |
| linux | linux | >= 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 < e4ae97295984ff1b9b340ed18ae1b066f36b7835 | e4ae97295984ff1b9b340ed18ae1b066f36b7835 |
| linux | linux | >= 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 < d81bd6671f45fde4c3ac7fd7733c6e3082ae9d8e | d81bd6671f45fde4c3ac7fd7733c6e3082ae9d8e |
| linux | linux | >= 8a56d7761d2d041ae5e8215d20b4167d8aa93f51 < c3b0f72e805f0801f05fa2aa52011c4bfc694c44 | c3b0f72e805f0801f05fa2aa52011c4bfc694c44 |
| linux | linux_kernel | < 4.9.327 | 4.9.327 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.148-1 | 5.10.148-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 4.10 < 4.14.292 | 4.14.292 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-49977: In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead f
osv·2025-06-18·CVSS 5.5
CVE-2022-49977 [MEDIUM] CVE-2022-49977: In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead f
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead ftrace_startup does not remove ops from ftrace_ops_list when ftrace_startup_enable fails: register_ftrace_function ftrace_startup __register_ftrace_function ... add_ftrace_ops(&ftrace_ops_list, ops) ... ... ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1 ... return 0 // ops is in the ftrace_ops_list. When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything: unregister_ftrace_function ftrace_shutdown if (unlikely(ftrace_disabled)) return -ENODEV; // return here, __unregister_ftrace_function is not executed, // as a result, ops is still in the ftrace_ops_list __unregister_ftrace_
GHSA
GHSA-gqp2-93hc-49w7: In the Linux kernel, the following vulnerability has been resolved:
ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
ghsa_unreviewed·2025-06-18
CVE-2022-49977 [MEDIUM] CWE-476 GHSA-gqp2-93hc-49w7: In the Linux kernel, the following vulnerability has been resolved:
ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
In the Linux kernel, the following vulnerability has been resolved:
ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
ftrace_startup does not remove ops from ftrace_ops_list when
ftrace_startup_enable fails:
register_ftrace_function
ftrace_startup
__register_ftrace_function
...
add_ftrace_ops(&ftrace_ops_list, ops)
...
...
ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1
...
return 0 // ops is in the ftrace_ops_list.
When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything:
unregister_ftrace_function
ftrace_shutdown
if (unlikely(ftrace_disabled))
return -ENODEV; // return here, __unregister_ftrace_function is not executed,
// as a result, ops is still in the ftrace_ops_list
__unregister_ftr
Red Hat
kernel: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
vendor_redhat·2025-06-18·CVSS 5.5
CVE-2022-49977 [MEDIUM] CWE-763 kernel: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
kernel: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
In the Linux kernel, the following vulnerability has been resolved:
ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
ftrace_startup does not remove ops from ftrace_ops_list when
ftrace_startup_enable fails:
register_ftrace_function
ftrace_startup
__register_ftrace_function
...
add_ftrace_ops(&ftrace_ops_list, ops)
...
...
ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1
...
return 0 // ops is in the ftrace_ops_list.
When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything:
unregister_ftrace_function
ftrace_shutdown
if (unlikely(ftrace_disabled))
return -ENODEV; // return here, __unregister_ftrace_function
Debian
CVE-2022-49977: linux - In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix...
vendor_debian·2022·CVSS 5.5
CVE-2022-49977 [MEDIUM] CVE-2022-49977: linux - In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix...
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead ftrace_startup does not remove ops from ftrace_ops_list when ftrace_startup_enable fails: register_ftrace_function ftrace_startup __register_ftrace_function ... add_ftrace_ops(&ftrace_ops_list, ops) ... ... ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1 ... return 0 // ops is in the ftrace_ops_list. When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything: unregister_ftrace_function ftrace_shutdown if (unlikely(ftrace_disabled)) return -ENODEV; // return here, __unregister_ftrace_function is not executed, // as a result, ops is still in the ftrace_ops_list __unregister_ftrace_
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/4c34a2a6c9927c239dd2e295a03d49b37b618d2chttps://git.kernel.org/stable/c/8569b4ada1e0b9bfaa125bd0c0967918b6560fa2https://git.kernel.org/stable/c/934e49f7d696afdae9f979abe3f308408184e17bhttps://git.kernel.org/stable/c/c3b0f72e805f0801f05fa2aa52011c4bfc694c44https://git.kernel.org/stable/c/d81bd6671f45fde4c3ac7fd7733c6e3082ae9d8ehttps://git.kernel.org/stable/c/dbd8c8fc60480e3faa3ae7e27ebe03371ecd1b77https://git.kernel.org/stable/c/ddffe882d74ef43a3494f0ab0c24baf076c45f96https://git.kernel.org/stable/c/e4ae97295984ff1b9b340ed18ae1b066f36b7835
2025-06-18
Published