In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ftrace: Take trace_array reference before accessing its ftrace_ops<\/p>\n
The trace instance files set_ftrace_filter and set_ftrace_notrace was
\nupdated to work with specific trace instances (trace_arrays). The issue is
\nthat when these files are opened, there is a small race window where it
\nwill use the ftrace_ops from the inode->private pointer to get a reference
\nto the trace_array and then take its reference. The problem is that the
\nftrace_ops itself could be freed. If the rmdir on the instance happens at
\nthe same time the set_ftrace_filter file is opened, the rmdir could have
\nalso freed the ftrace_ops and referencing it will cause a use-after-free
\nbug and crash the kernel.<\/p>\n
Instead, pass in the trace_array as the file private data (NULL for the
\ntop level instance), and then pass both the trace_array and the ftrace_ops
\nto the ftrace_regex_open() function. If the trace_array is NULL, then it
\njust uses the ftrace_ops without the need to take its reference (like
\nnormal). If the ftrace_ops is NULL, that is only the case for the top
\nlevel instance and the global_ops can be used.<\/p>\n
This allows the trace_array to have its reference incremented before
\ntouching the ftrace_ops that could also be freed when the instance is.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ftrace: Take trace_array reference before accessing its ftrace_ops<\/p>\n
The trace instance files set_ftrace_filter and set_ftrace_notra<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24690","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24690","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24690"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}