Executive brief
The Linux kernel's fprobe tracing facility contains a race condition in its shutdown logic that can cause a general protection fault. When unregistering an fprobe, the rethook handler was freed before ensuring all running instances on other CPUs had completed, potentially leading to kernel crashes or system instability. This affects systems using BPF (Berkeley Packet Filter) tracing and monitoring capabilities.
Technical details
This is a use-after-free race condition in the kernel's fprobe tracing mechanism (kernel/trace/fprobe.c). The vulnerability occurs in the unregister_fprobe() function where rethook_free() was called before unregister_ftrace_function(), leaving a window where running rethook handlers on other CPUs could still attempt to access the freed rethook structure, causing a general protection fault. The fix reorders these operations so that unregister_ftrace_function() is called first to ensure all active handlers complete before rethook_free() deallocates the structure. This requires local privileged access to load or unload BPF programs that use fprobe. The patch was merged upstream in June 2023.
Affected products
- Linux Linux kernel 5.16 and later versions before fix in June 2023
Timeline
- 2023-06-15: disclosed: Fix submitted by Jiri Olsa
- 2023-06-27: patched: Fix merged upstream
- 2023-07-23: patched: Fix backported to stable trees