PT-2024-33841 · Linux+8 · Linux Kernel+8
Jinjie Ruan
·
Published
2024-10-21
·
Updated
2026-03-14
·
CVE-2024-50002
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 6.6.58
Description:
The issue arises from the
static call del module() function, which fails to handle module initialization failures correctly. When a module is inserted, static call add module() is invoked to initialize static calls. If an allocation failure occurs during this process, static call del module() is called to clean up. However, this function blindly assumes that key::mods points to a valid struct static call mod, leading to a #GP error when it's actually a pointer to built-in usage sites. The problem stems from the key::mods being part of a union, where the type of the pointer is differentiated by bit 0. To fix this, it's necessary to check whether the key has a sites or a mods pointer. If it's a sites pointer, the key should not be touched, and the site walk can be terminated.Recommendations:
For Linux kernel versions prior to 6.6.58, update to version 6.6.58 or later to resolve the issue. As a temporary workaround, consider disabling the
static call del module() function until a patch is available. Restrict access to the vulnerable static call add module() function to minimize the risk of exploitation. Avoid using the key::mods pointer in the affected static call del module() function until the issue is resolved.Exploit
Fix
DoS
Improper Handling of Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu