Linux Kernel Kprobes Test Suite Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the Linux kernel's kprobes test suite. When the kprobes sanity tests are run twice, all tests fail and the kernel eventually crashes. This issue arises because the test suite defines several kprobes and kretprobes as static variables that persist across test runs. After a kprobe is registered and then unregistered, it retains some residual data that must be cleared before it can be registered again. The tests set the symbol_name to define the probe location, and both the address and flags need to be cleared. While the existing code clears some probes between subsequent tests, it does not do so between two test runs. The leftover data from the first test run causes the registrations to fail in the next run, leading to a crash. The vulnerability affects the Linux kernel stable tree.

Impact

Running the kprobes test suite twice causes all tests to fail and eventually crashes the kernel.

Reproduction

The vulnerability can be reproduced by running the kprobes sanity tests twice. The first run completes successfully, but the second run fails and crashes the kernel. This failure occurs because the test suite's kprobes and kretprobes retain data from the first run, causing registration errors that lead to a kernel crash.

Remediation

The vulnerability has been addressed in the Linux kernel by modifying the kprobes test suite to clear the residual data from kprobes and kretprobes before each test run. Users can apply the latest patches from the Linux kernel stable tree to address this issue.