CVE-2022-50008

MEDIUM EPSS 10.4%
Published Jun 18, 20251y ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Jun 18, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: kprobes: don't call disarm_kprobe() for disabled kprobes The assumption in __disable_kprobe() is wrong, and it could try to disarm an already disarmed kprobe and fire the WARN_ONCE() below. [0] We can easily reproduce this issue. 1. Write 0 to /sys/kernel/debug/kprobes/enabled. # echo 0 > /sys/kernel/debug/kprobes/enabled 2. Run execsnoop. At this time, one kprobe is disabled. # /usr/share/bcc/tools/execsnoop & [1] 2460 PCOMM PID PPID RET ARGS # cat /sys/kernel/debug/kprobes/list ffffffff91345650 r __x64_sys_execve+0x0 [FTRACE] ffffffff91345650 k __x64_sys_execve+0x0 [DISABLED][FTRACE] 3. Write 1 to /sys/kernel/debug/kprobes/enabled, which changes kprobes_all_disarmed to false but does not arm the disabled kprobe. # echo 1 > /sys/kernel/debug/kprobes/enabled # cat /sys/kernel/debug/kprobes/list ffffffff91345650 r __x64_sys_execve+0x0 [FTRACE] ffffffff91345650 k __x64_sys_execve+0x0 [DISABLED][FTRACE] 4. Kill execsnoop, when __disable_kprobe() calls disarm_kprobe() for the disabled kprobe and hits the WARN_ONCE() in __disarm_kprobe_ftrace(). # fg /usr/share/bcc/tools/execsnoop ^C Actually, WARN_ONCE() is fired twice, and __unregister_kprobe_top() misses some cleanups and leaves the aggregated kprobe in the hash table. Then, __unregister_trace_kprobe() initialises tk->rp.kp.list and creates an infinite loop like this. aggregated kprobe.list -> kprobe.list -. ^ | '.__.' In this situation, these commands fall into the infinite loop and result in RCU stall or soft lockup. cat /sys/kernel/debug/kprobes/list : show_kprobe_addr() enters into the infinite loop with RCU. /usr/share/bcc/tools/execsnoop : warn_kprobe_rereg() holds kprobe_mutex, and __get_valid_kprobe() is stuck in the loop. To avoid the issue, make sure we don't call disarm_kprobe() for disabled kprobes. [0] Failed to disarm kprobe-ftrace at __x64_sys_execve+0x0/0x40 (error -2) WARNING: CPU: 6 PID: 2460 at kernel/kprobes.c:1130 __disarm_kprobe_ftrace.isra.19 (kernel/kprobes.c:1129) Modules linked in: ena CPU: 6 PID: 2460 Comm: execsnoop Not tainted 5.19.0+ #28 Hardware name: Amazon EC2 c5.2xlarge/, BIOS 1.0 10/16/2017 RIP: 0010:__disarm_kprobe_ftrace.isra.19 (kernel/kprobes.c:1129) Code: 24 8b 02 eb c1 80 3d c4 83 f2 01 00 75 d4 48 8b 75 00 89 c2 48 c7 c7 90 fa 0f 92 89 04 24 c6 05 ab 83 01 e8 e4 94 f0 ff <0f> 0b 8b 04 24 eb b1 89 c6 48 c7 c7 60 fa 0f 92 89 04 24 e8 cc 94 RSP: 0018:ffff9e6ec154bd98 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffff930f7b00 RCX: 0000000000000001 RDX: 0000000080000001 RSI: ffffffff921461c5 RDI: 00000000ffffffff RBP: ffff89c504286da8 R08: 0000000000000000 R09: c0000000fffeffff R10: 0000000000000000 R11: ffff9e6ec154bc28 R12: ffff89c502394e40 R13: ffff89c502394c00 R14: ffff9e6ec154bc00 R15: 0000000000000000 FS: 00007fe800398740(0000) GS:ffff89c812d80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c00057f010 CR3: 0000000103b54006 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> __disable_kprobe (kernel/kprobes.c:1716) disable_kprobe (kernel/kprobes.c:2392) __disable_trace_kprobe (kernel/trace/trace_kprobe.c:340) disable_trace_kprobe (kernel/trace/trace_kprobe.c:429) perf_trace_event_unreg.isra.2 (./include/linux/tracepoint.h:93 kernel/trace/trace_event_perf.c:168) perf_kprobe_destroy (kernel/trace/trace_event_perf.c:295) _free_event (kernel/events/core.c:4971) perf_event_release_kernel (kernel/events/core.c:5176) perf_release (kernel/events/core.c:5186) __fput (fs/file_table.c:321) task_work_run (./include/linux/ ---truncated---

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
10.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-835

Affected Products 9

VendorProductVersionRange
linuxlinux_kernel*≥4.0  –  <4.9.327
linuxlinux_kernel*≥4.10  –  <4.14.292
linuxlinux_kernel*≥4.15  –  <4.19.257
linuxlinux_kernel*≥4.20  –  <5.4.212
linuxlinux_kernel*≥5.5  –  <5.10.141
linuxlinux_kernel*≥5.11  –  <5.15.65
linuxlinux_kernel*≥5.16  –  <5.19.6
linuxlinux_kernel6.0any
linuxlinux_kernel6.0any

References 8

  • git.kernel.org https://git.kernel.org/stable/c/19cd630712e7c13a3dedfc6986a9b983fed6fd98
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/55c7a91527343d2e0b5647cc308c6e04ddd2aa52
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6f3c1bc22fc2165461883f506b4d2c3594bd7137
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/744b0d3080709a172f0408aedabd1cedd24c2ee6
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9c80e79906b4ca440d09e7f116609262bb747909
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b474ff1b20951f1eac75d100a93861e6da2b522b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/bc3188d8a3b8c08c306a4c851ddb2c92ba4599ca
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fc91d2db55acdaf0c0075b624e572d3520ca3bc3
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/19cd630712e7c13a3dedfc6986a9b983fed6fd98
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/55c7a91527343d2e0b5647cc308c6e04ddd2aa52
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6f3c1bc22fc2165461883f506b4d2c3594bd7137
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/744b0d3080709a172f0408aedabd1cedd24c2ee6
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9c80e79906b4ca440d09e7f116609262bb747909
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b474ff1b20951f1eac75d100a93861e6da2b522b
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/bc3188d8a3b8c08c306a4c851ddb2c92ba4599ca
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fc91d2db55acdaf0c0075b624e572d3520ca3bc3
    Patch