Executive brief
A vulnerability exists in the Linux kernel's ftrace component, which is used for analyzing system performance and behavior. A local attacker could exploit this flaw to cause a system crash or potentially gain unauthorized access to sensitive information. This issue affects various industrial control systems and embedded devices that rely on the Linux kernel.
Technical details
A use-after-free (UAF) vulnerability exists in kernel/trace/ftrace.c due to improper handling of filter hashes during read operations of 'set_ftrace_filter' and 'set_ftrace_notrace'. While write operations correctly allocate a copy of the hash, read operations previously maintained a pointer to the global tracer hash. Because this pointer remains static across function calls that release locks, the global hash can be updated or freed while the reader still holds the reference. An attacker with local access can trigger this race condition to achieve a use-after-free state. Patches have been released for multiple stable kernel branches to ensure readers also allocate and copy the hash.
Affected products
- Linux Linux kernel/trace/ftrace.c
- Siemens SIMATIC CN 4100 < V5.0
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
Timeline
- 2025-08-22: other: Patch authored
- 2025-09-05: advisory: Initial publication date
References
- https://git.kernel.org/stable/c/12064e1880fc9202be75ff668205b1703d92f74f
- https://git.kernel.org/stable/c/3b114a3282ab1a12cb4618a8f45db5d7185e784a
- https://git.kernel.org/stable/c/64db338140d2bad99a0a8c6a118dd60b3e1fb8cb
- https://git.kernel.org/stable/c/a40c69f4f1ed96acbcd62e9b5ff3a596f0a91309
- https://git.kernel.org/stable/c/bfb336cf97df7b37b2b2edec0f69773e06d11955
- https://git.kernel.org/stable/c/c4cd93811e038d19f961985735ef7bb128078dfb
- https://git.kernel.org/stable/c/c591ba1acd081d4980713e47869dd1cc3d963d19