CVE-2024-35955: kprobes: Fix possible use-after-free issue on kprobe registration
In the Linux kernel, the following vulnerability has been resolved:
kprobes: Fix possible use-after-free issue on kprobe registration
When unloading a module, its state is changing MODULE_STATE_LIVE ->
MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take
a time. `is_module_text_address()` and `__module_text_address()`
works with MODULE_STATE_LIVE and MODULE_STATE_GOING.
If we use `is_module_text_address()` and `__module_text_address()`
separately, there is a chance that the first one is succeeded but the
next one is failed because module->state becomes MODULE_STATE_UNFORMED
between those operations.
In `check_kprobe_address_safe()`, if the second `__module_text_address()`
is failed, that is ignored because it expected a kernel_text address.
But it may have failed simply because module->state has been changed
to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify
non-exist module text address (use-after-free).
To fix this problem, we should not use separated `is_module_text_address()`
and `__module_text_address()`, but use only `__module_text_address()`
once and do `try_module_get(module)` which is only available with
MODULE_STATE_LIVE.
Security readout for executives and security teams
Plain-English summary
CVE-2024-35955 is a Linux kernel memory-safety flaw in kprobes. During a race between registering a kprobe and unloading a kernel module, the kernel may touch module text that no longer exists. Impact is high because successful exploitation could affect confidentiality, integrity, and availability.
Executive priority
Treat as a high-priority kernel maintenance issue. It is not marked as known exploited, but kernel memory corruption with high impact can become serious in shared, internet-facing, or appliance environments when updates lag.
Technical view
The flaw is a CWE-416 use-after-free in kprobe registration. The vulnerable path separately checks module text and later resolves the module; the module can move to MODULE_STATE_UNFORMED between those operations. The fix uses __module_text_address() once and try_module_get() only for live modules.
Likely exposure
Linux systems running affected kernel builds are the exposure area, especially where loadable modules and kprobes are enabled. Debian and Siemens references show downstream relevance, but exact exposure depends on each distribution, appliance, or vendor kernel build.
Exploitation context
The supplied CVSS vector is AV:N/AC:L/PR:L/UI:N with high CIA impact. However, the bundle marks KEV as false and provides no cited evidence of active exploitation or public exploit availability.
Researcher notes
Focus validation on the kprobe registration race around module unload state transitions. The source bundle supports the root cause and fix direction, but does not provide exploitability details, affected distribution matrices beyond references, or compensating controls.
Mitigation direction
Apply Linux kernel stable fixes or vendor kernel updates for affected branches.
Check Debian, Siemens, and other vendor advisories for product-specific patched builds.
Prioritize systems permitting privileged or semi-privileged kernel tracing activity.
If no vendor fix is available, follow vendor guidance for temporary risk reduction.
Validation and detection
Inventory Linux kernel versions and map them to vendor-fixed builds.
Confirm whether affected systems expose kprobes and loadable module functionality.
Review vendor advisories for product-specific affected and fixed version statements.
Verify patched kernels include the referenced stable commits for the relevant branch.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cwe · low confidence lookup
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
3ADP providers
13Source links
SSVC decision data
CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE-416 · source CWE mapping
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.