LiveActive security incident?Get immediate response
CVE Record

CVE-2024-35955: kprobes: Fix possible use-after-free issue on kprobe registration

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration When unloading a module, its state is changing MODULE_STATE_LIVE -> MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take a time. `is_module_text_address()` and `__module_text_address()` works with MODULE_STATE_LIVE and MODULE_STATE_GOING. If we use `is_module_text_address()` and `__module_text_address()` separately, there is a chance that the first one is succeeded but the next one is failed because module->state becomes MODULE_STATE_UNFORMED between those operations. In `check_kprobe_address_safe()`, if the second `__module_text_address()` is failed, that is ignored because it expected a kernel_text address. But it may have failed simply because module->state has been changed to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify non-exist module text address (use-after-free). To fix this problem, we should not use separated `is_module_text_address()` and `__module_text_address()`, but use only `__module_text_address()` once and do `try_module_get(module)` which is only available with MODULE_STATE_LIVE.

HighCVSS 8.8Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2024-35955 is a Linux kernel memory-safety flaw in kprobes. During a race between registering a kprobe and unloading a kernel module, the kernel may touch module text that no longer exists. Impact is high because successful exploitation could affect confidentiality, integrity, and availability.

Executive priority

Treat as a high-priority kernel maintenance issue. It is not marked as known exploited, but kernel memory corruption with high impact can become serious in shared, internet-facing, or appliance environments when updates lag.

Technical view

The flaw is a CWE-416 use-after-free in kprobe registration. The vulnerable path separately checks module text and later resolves the module; the module can move to MODULE_STATE_UNFORMED between those operations. The fix uses __module_text_address() once and try_module_get() only for live modules.

Likely exposure

Linux systems running affected kernel builds are the exposure area, especially where loadable modules and kprobes are enabled. Debian and Siemens references show downstream relevance, but exact exposure depends on each distribution, appliance, or vendor kernel build.

Exploitation context

The supplied CVSS vector is AV:N/AC:L/PR:L/UI:N with high CIA impact. However, the bundle marks KEV as false and provides no cited evidence of active exploitation or public exploit availability.

Researcher notes

Focus validation on the kprobe registration race around module unload state transitions. The source bundle supports the root cause and fix direction, but does not provide exploitability details, affected distribution matrices beyond references, or compensating controls.

Mitigation direction

  • Apply Linux kernel stable fixes or vendor kernel updates for affected branches.
  • Check Debian, Siemens, and other vendor advisories for product-specific patched builds.
  • Prioritize systems permitting privileged or semi-privileged kernel tracing activity.
  • If no vendor fix is available, follow vendor guidance for temporary risk reduction.

Validation and detection

  • Inventory Linux kernel versions and map them to vendor-fixed builds.
  • Confirm whether affected systems expose kprobes and loadable module functionality.
  • Review vendor advisories for product-specific affected and fixed version statements.
  • Verify patched kernels include the referenced stable commits for the relevant branch.
Prepared
Confidence
medium
Sources
12

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-416: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-35955 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
3ADP providers
13Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

8.8High
CVSS 3.1 vector shape for CVE-2024-35955Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container
siemens-SADPADP container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1c836bad43f3e2ff71cc397a6e6ccb4e7bd116f8, 6a119c1a584aa7a2c6216458f1f272bf1bc93a93, 2a49b025c36ae749cee7ccc4b7e456e02539cdc3, a1edb85e60fdab1e14db63ae8af8db3f0d798fb6, 28f6c37a2910f565b4f5960df52b2eccae28c891, 28f6c37a2910f565b4f5960df52b2eccae28c891, 28f6c37a2910f565b4f5960df52b2eccae28c891, 28f6c37a2910f565b4f5960df52b2eccae28c891, 4262b6eb057d86c7829168c541654fe0d48fdac8, 97e813e6a143edf4208e15c72199c495ed80cea5, 16a544f1e013ba0660612f3fe35393b143b19a84unaffected
LinuxLinux6.0, 0, 4.19.313, 5.4.275, 5.10.216, 5.15.157, 6.1.87, 6.6.28, 6.8.7, 6.9affected
Weakness

CWE details

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-416 · source CWE mapping

Use After Free

Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.