Fix possible use-after-free issue on kprobe registration

CVE-2024-35955

Summary

A vulnerability in the Linux kernel's handling of kprobe registrations has been identified, which can lead to a use-after-free condition during module unloading. When a module is being unloaded, its state transitions from LIVE to GOING and finally to UNFORMED. This transition occurs sequentially, allowing a time window where operations like is_module_text_address() and __module_text_address() could mistakenly reference a module's text address even after its state has changed to UNFORMED. The flaw occurs if the kernel attempts to modify an address that is no longer valid, leading to potential security risks. The recommended mitigation is to avoid utilizing separate checks and to call __module_text_address() only once, ensuring module integrity.

References