CVE-2023-53557

In the Linux kernel, the following vulnerability has been resolved:

fprobe: Release rethook after the ftrace_ops is unregistered

While running bpf selftests it's possible to get following fault:

general protection fault, probably for non-canonical address
0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI ... Call Trace: <TASK> fprobe_handler+0xc1/0x270 ? __pfx_bpf_testmod_init+0x10/0x10 ? __pfx_bpf_testmod_init+0x10/0x10 ? bpf_fentry_test1+0x5/0x10 ? bpf_fentry_test1+0x5/0x10 ? bpf_testmod_init+0x22/0x80 ? do_one_initcall+0x63/0x2e0 ? rcu_is_watching+0xd/0x40 ? kmalloc_trace+0xaf/0xc0 ? do_init_module+0x60/0x250 ? __do_sys_finit_module+0xac/0x120 ? do_syscall_64+0x37/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc </TASK>

In unregister_fprobe function we can't release fp->rethook while it's possible there are some of its users still running on another cpu.

Moving rethook_free call after fp->ops is unregistered with unregister_ftrace_function call.

A low-severity race condition was found in the Linux kernel's fprobe subsystem (kernel/trace/fprobe.c). The unregister_fprobe() function released the fp->rethook object via rethook_free() while the associated ftrace operations were still registered, so fprobe_handler() could still be executing on another CPU and access rethook memory that had already been freed, causing a general protection fault and crashing the kernel (a use-after-free in the handler path). Exploiting this race requires local access and the ability to register and unregister fprobes, for example through BPF selftests or tracing frameworks, which is restricted to privileged users, so the practical consequence for Red Hat Enterprise Linux is local denial of service. For this reason Red Hat rates the flaw Low severity with CVSS 3.1 score 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while the upstream CVE record assigns a higher score of 7.8 that includes confidentiality and integrity impacts; Red Hat assesses those impacts as not supported by the evidence, because the flaw manifests only as a kernel crash. In Red Hat Enterprise Linux 9, the kernel and kernel-rt components are affected; the fix is deferred to a future update because of the low impact and the limited, privilege-gated attack surface, leaving a residual risk that a local privileged user can trigger a kernel crash. Red Hat Enterprise Linux 6, 7, 8, and 10, as well as Red Hat In-Vehicle OS, are not affected because the vulnerable code is not present in those streams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.