Vulnerability in Kernel: kprobes Disarmment
Summary
GSD-2022-1005955: kprobes: don't call disarm_kprobe() for disabled kprobes. Affects Kernel versions >= 69d54b916d83872a0a327778a01af2a096923f59, < b474ff1b20951f1eac75d100a93861e6da2b522b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a fundamental component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential functionalities such as process management, memory management, and device drivers. The kprobes feature in the Kernel allows developers to dynamically instrument code by inserting breakpoints and executing custom handlers. This enables debugging, performance analysis, and other runtime modifications. However, a vulnerability has been identified in the kprobes implementation that could lead to potential security risks.
Vulnerability Detail
The vulnerability in the kprobes feature involves the improper handling of disabled kprobes. When attempting to disarm a disabled kprobe, the disarm_kprobe() function is called, which can result in unexpected behavior and potential security implications. The exact impact and attack vectors are yet to be proven, but this vulnerability could potentially be exploited by malicious actors to bypass security measures, execute arbitrary code, or gain elevated privileges. The vulnerability was introduced in version 4.0 of the Linux Kernel and has been fixed in version 5.4.212.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the kprobes feature entirely if it is not essential for their system's functionality. This can be achieved by modifying the Kernel configuration and rebuilding the Kernel without the kprobes feature. However, this workaround may not be feasible for systems relying on kprobes for critical operations.
Conclusion
In conclusion, a vulnerability has been identified in the Kernel's kprobes feature, which could potentially be exploited by attackers. It is crucial to update the Linux Kernel to version 5.4.212 or later to address this vulnerability. Users can also utilize the Vulert Playground at https://vulert.com/scanner to check if their system is affected and obtain further assistance in vulnerability remediation. Stay proactive in maintaining the security of your system.
See every vulnerability recorded for Kernel →
FAQ
The exact impact of this vulnerability is yet to be proven. However, it could potentially be exploited by attackers to bypass security measures, execute arbitrary code, or gain elevated privileges.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this specific issue.
As of now, there is no known exploit for this vulnerability. However, it is crucial to apply the recommended fix or update the Kernel to mitigate any potential risks.
As a temporary measure, you can disable the kprobes feature if it is not essential for your system's functionality. However, it is highly recommended to update the Kernel as soon as possible to ensure the security of your system.
The primary solution to mitigate this vulnerability is to update the Linux Kernel to the fixed version. Disabling the kprobes feature is a temporary workaround but may not be suitable for systems relying on kprobes for critical operations.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
