Linux Kernel Kprobes Vulnerability in Ftrace-Based Probes

A vulnerability in the Linux kernel's kprobes mechanism can lead to a use-after-free error, particularly in ftrace-based probes. When unregistering a kprobe, if the probe has a post-handler but its child probes do not, the post-handler for the aggregate probe is cleared. This creates a mismatch, as the kprobe is disarmed using the wrong operations, triggering a warning and potentially causing a use-after-free error. The issue arises in version 6.1.0-rc4-dirty.

Impact

The vulnerability can cause a use-after-free error, which may lead to memory corruption and potentially allow for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by creating an ftrace-based kprobe with a post-handler, and then unregistering it while other child probes lack post-handlers. This will clear the post-handler of the aggregate probe, leading to a warning and a use-after-free error when the probe is disarmed.