Executive brief
A vulnerability in the Linux kernel's tracing subsystem can lead to system instability or resource exhaustion. Specifically, certain test modules for event generation (kprobes and synthetic events) do not properly release references when built directly into the kernel rather than as loadable modules. This can cause kernel warnings, self-test failures, and prevent the cleanup of dynamic events, potentially impacting the reliability of system monitoring and debugging tools.
Technical details
The vulnerability exists in the kprobes and synthetic (synth) event generation test modules within the Linux kernel tracing subsystem. These modules are designed to acquire references (locks) to event files during initialization and release them during exit. However, when these modules are compiled as built-in (y) instead of loadable modules (m), the exit functions are never called, leaving event references permanently locked. This results in a kernel WARNING in 'kprobe_trace_self_tests_init' and prevents the cleanup of 'dynamic_event' files, causing 'ftracetest' failures. The fix involves modifying the Kconfig to ensure these test components can only be built as modules.
Affected products
- Linux Linux Kernel from 5.1 before 6.9.9
Timeline
- 2024-06-11: disclosed: Initial patch submission by Masami Hiramatsu
- 2024-07-12: advisory: CVE-2024-41004 published
References
- https://git.kernel.org/stable/c/32ef4dc2b1caf5825c0cf50646479608311cafc3
- https://git.kernel.org/stable/c/3572bd5689b0812b161b40279e39ca5b66d73e88
- https://git.kernel.org/stable/c/55d5d08174366efe57ca9e79964828b20c626c45
- https://git.kernel.org/stable/c/72a0199b361df2387018697b023fdcdd357449a9
- https://git.kernel.org/stable/c/98a7bfc48fffe170a60d87a5cbb7cdddf08184c3
- https://git.kernel.org/stable/c/a85bae262ccecc52a40c466ec067f6c915e0839d
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html