Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-50099— arm64: probes: Remove broken LDR (literal) uprobe support

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于arm64模块在 uprobes 支持中未能正确处理LDR（literal）和LDRSW（literal）指令，可能导致内核崩溃。

CVSS 7.3 · High EPSS 0.27% · P19

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 9842ceae9fa8deae141533d52a6ead7666962c09< cc86f2e9876c8b5300238cec6bf0bd8c842078ee affected
9842ceae9fa8deae141533d52a6ead7666962c09< ae743deca78d9e4b7f4f60ad2f95e20e8ea057f9 affected
9842ceae9fa8deae141533d52a6ead7666962c09< 3728b4eb27910ffedd173018279a970705f2e03a affected
9842ceae9fa8deae141533d52a6ead7666962c09< ad4bc35a6d22e9ff9b67d0d0c38bce654232f195 affected
9842ceae9fa8deae141533d52a6ead7666962c09< bae792617a7e911477f67a3aff850ad4ddf51572 affected
9842ceae9fa8deae141533d52a6ead7666962c09< 9f1e7735474e7457a4d919a517900e46868ae5f6 affected
9842ceae9fa8deae141533d52a6ead7666962c09< 20cde998315a3d2df08e26079a3ea7501abce6db affected
9842ceae9fa8deae141533d52a6ead7666962c09< acc450aa07099d071b18174c22a1119c57da8227 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-50099

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
arm64: probes: Remove broken LDR (literal) uprobe support
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: arm64: probes: Remove broken LDR (literal) uprobe support The simulate_ldr_literal() and simulate_ldrsw_literal() functions are unsafe to use for uprobes. Both functions were originally written for use with kprobes, and access memory with plain C accesses. When uprobes was added, these were reused unmodified even though they cannot safely access user memory. There are three key problems: 1) The plain C accesses do not have corresponding extable entries, and thus if they encounter a fault the kernel will treat these as unintentional accesses to user memory, resulting in a BUG() which will kill the kernel thread, and likely lead to further issues (e.g. lockup or panic()). 2) The plain C accesses are subject to HW PAN and SW PAN, and so when either is in use, any attempt to simulate an access to user memory will fault. Thus neither simulate_ldr_literal() nor simulate_ldrsw_literal() can do anything useful when simulating a user instruction on any system with HW PAN or SW PAN. 3) The plain C accesses are privileged, as they run in kernel context, and in practice can access a small range of kernel virtual addresses. The instructions they simulate have a range of +/-1MiB, and since the simulated instructions must itself be a user instructions in the TTBR0 address range, these can address the final 1MiB of the TTBR1 acddress range by wrapping downwards from an address in the first 1MiB of the TTBR0 address range. In contemporary kernels the last 8MiB of TTBR1 address range is reserved, and accesses to this will always fault, meaning this is no worse than (1). Historically, it was theoretically possible for the linear map or vmemmap to spill into the final 8MiB of the TTBR1 address range, but in practice this is extremely unlikely to occur as this would require either: * Having enough physical memory to fill the entire linear map all the way to the final 1MiB of the TTBR1 address range. * Getting unlucky with KASLR randomization of the linear map such that the populated region happens to overlap with the last 1MiB of the TTBR address range. ... and in either case if we were to spill into the final page there would be larger problems as the final page would alias with error pointers. Practically speaking, (1) and (2) are the big issues. Given there have been no reports of problems since the broken code was introduced, it appears that no-one is relying on probing these instructions with uprobes. Avoid these issues by not allowing uprobes on LDR (literal) and LDRSW (literal), limiting the use of simulate_ldr_literal() and simulate_ldrsw_literal() to kprobes. Attempts to place uprobes on LDR (literal) and LDRSW (literal) will be rejected as arm_probe_decode_insn() will return INSN_REJECTED. In future we can consider introducing working uprobes support for these instructions, but this will require more significant work.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于arm64模块在 uprobes 支持中未能正确处理LDR（literal）和LDRSW（literal）指令，可能导致内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 9842ceae9fa8deae141533d52a6ead7666962c09 ~ cc86f2e9876c8b5300238cec6bf0bd8c842078ee -
Linux Linux 4.10 -

II. Public POCs for CVE-2024-50099

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-50099

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-50099 (8)

Same Patch Batch · Linux · 2024-11-05 · 50 CVEs total

CVE-2024-50106 9.8 CRITICAL nfsd: fix race between laundromat and free_stateid
CVE-2024-50113 8.8 HIGH firewire: core: fix invalid port index for parent device
CVE-2024-50115 8.4 HIGH KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
CVE-2024-50125 8.0 HIGH Bluetooth: SCO: Fix UAF on sco_sock_timeout
CVE-2024-50124 8.0 HIGH Bluetooth: ISO: Fix UAF on iso_sock_timeout
CVE-2024-50132 7.8 HIGH tracing/probes: Fix MAX_TRACE_ARGS limit handling
CVE-2023-52920 7.8 HIGH bpf: support non-r10 register spill/fill to/from stack in precision tracking
CVE-2024-50101 7.8 HIGH iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices
CVE-2024-50091 7.8 HIGH dm vdo: don't refer to dedupe_context after releasing it
CVE-2024-50114 7.8 HIGH KVM: arm64: Unregister redistributor for failed vCPU creation
CVE-2024-50127 7.8 HIGH net: sched: fix use-after-free in taprio_change()
CVE-2024-50126 7.8 HIGH net: sched: use RCU read-side critical section in taprio_dump()
CVE-2024-50128 7.8 HIGH net: wwan: fix global oob in wwan_rtnl_policy
CVE-2024-50130 7.8 HIGH netfilter: bpf: must hold reference on net namespace
CVE-2024-50090 7.8 HIGH drm/xe/oa: Fix overflow in oa batch buffer
CVE-2024-50094 7.5 HIGH sfc: Don't invoke xdp_do_flush() from netpoll.
CVE-2024-50095 7.5 HIGH RDMA/mad: Improve handling of timed out WRs of mad agent
CVE-2024-50117 7.3 HIGH drm/amd: Guard against bad data for ATIF ACPI method
CVE-2024-50131 7.3 HIGH tracing: Consider the NULL character when validating the event length
CVE-2024-50096 7.3 HIGH nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error

Showing top 20 of 50 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-50099

No comments yet

Leave a comment