Linux Kernel BPF Use-After-Free Vulnerability Due to Module Initialization Race

A use-after-free vulnerability has been identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. This issue arises from a race condition between the BPF Type Format (BTF) module handling and the loading of kernel modules. When a kernel module is initialized, its BTF can be accessed by userspace and the BPF verifier before the module is fully ready. This premature access can lead to a situation where a BPF program successfully loads, but the module is subsequently freed, causing a use-after-free error when the BPF program is closed. The vulnerability has been addressed by modifying the BTF module handling to ensure that only fully initialized modules are accessed, thus preventing the race condition and the associated use-after-free vulnerability.

Impact

Exploitation of this vulnerability leads to a use-after-free condition, where a freed module is accessed, potentially causing memory corruption or allowing for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by loading a BPF program that requires a kernel module's BTF information before the module has completed its initialization. This can be done by triggering the module's 'coming' state and then immediately loading the BPF program, before the module has fully transitioned to the 'live' state.

Remediation

Users should upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.