CVE-2024-35955: Debian Linux

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration When unloading a module, its state is changing MODULE_STATE_LIVE -> MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take a time. `is_module_text_address()` and `__module_text_address()` works with MODULE_STATE_LIVE and MODULE_STATE_GOING. If we use `is_module_text_address()` and `__module_text_address()` separately, there is a chance that the first one is succeeded but the next one is failed because module->state becomes MODULE_STATE_UNFORMED between those operations. In `check_kprobe_address_safe()`, if the second `__module_text_address()` is failed, that is ignored because it expected a kernel_text address. But it may have failed simply because module->state has been changed to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify non-exist module text address (use-after-free). To fix this problem, we should not use separated `is_module_text_address()` and `__module_text_address()`, but use only `__module_text_address()` once and do `try_module_get(module)` which is only available with MODULE_STATE_LIVE.

Affected products

• Debian Debian Linux: version 10.0 only
• Linux Linux Kernel: from 4.14.291, before 4.15 (fixed in 4.15); from 4.19.256, before 4.19.313 (fixed in 4.19.313); from 5.4.211, before 5.4.275 (fixed in 5.4.275); from 5.10.137, before 5.10.216 (fixed in 5.10.216); from 5.15.61, before 5.15.157 (fixed in 5.15.157); from 5.18.18, before 5.19 (fixed in 5.19); …

Published 2024-05-20. Last modified 2026-06-17.