Linux Kernel Kprobes Module Crash Vulnerability After Ftrace Deactivation

A vulnerability in the Linux kernel's kprobes module can lead to a crash when removing modules that have kprobes attached, after ftrace has been disabled by an error. This issue occurs because the kprobe on ftrace does not properly manage the kprobe_ftrace_disabled flag, which is set when ftrace is killed. The problem manifests as a page fault error, indicating that the kernel is trying to access an invalid memory address.

Impact

The vulnerability causes a kernel crash, specifically a page fault error, when modules with kprobes are removed after ftrace has been disabled.

Reproduction

To reproduce this vulnerability, first induce an error that causes ftrace to be killed. After ftrace is disabled, attempt to remove a kernel module that has kprobes attached. This will trigger a kernel crash due to an unhandled page fault.

Remediation

The vulnerability has been addressed in the Linux kernel. Users should upgrade to the latest version where this issue has been fixed.