Linux Kernel ftrace Use-After-Free Vulnerability via Kprobe Tracepoint

A use-after-free vulnerability has been identified in the Linux kernel's ftrace functionality. This issue arises when a module using kprobes disables ftrace, leading to a race condition. Specifically, the problem occurs because ftrace_mod_get_kallsym accesses module information that has already been freed, triggered by a sequence of loading and unloading the module while ftrace is disabled.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, potentially allowing for arbitrary code execution or memory corruption.

Reproduction

To reproduce this vulnerability, first add a kprobe tracepoint. Then, load a test module that triggers an ftrace disable. Afterward, remove the test module and access /proc/kallsyms, which will invoke the ftrace function that accesses freed memory, causing the use-after-free vulnerability.