CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

CVE-2024-50002: static_call: Handle module init failure correctly in static_call_del_module()

Description

In the Linux kernel, the following vulnerability has been resolved:

static_call: Handle module init failure correctly in static_call_del_module()

Module insertion invokes static_call_add_module() to initialize the static
calls in a module. static_call_add_module() invokes __static_call_init(),
which allocates a struct static_call_mod to either encapsulate the built-in
static call sites of the associated key into it so further modules can be
added or to append the module to the module chain.

If that allocation fails the function returns with an error code and the
module core invokes static_call_del_module() to clean up eventually added
static_call_mod entries.

This works correctly, when all keys used by the module were converted over
to a module chain before the failure. If not then static_call_del_module()
causes a #GP as it blindly assumes that key::mods points to a valid struct
static_call_mod.

The problem is that key::mods is not a individual struct member of struct
static_call_key, it's part of a union to save space:

union {
/* bit 0: 0 = mods, 1 = sites */
unsigned long type;
struct static_call_mod *mods;
struct static_call_site *sites;
};

key::sites is a pointer to the list of built-in usage sites of the static
call. The type of the pointer is differentiated by bit 0. A mods pointer
has the bit clear, the sites pointer has the bit set.

As static_call_del_module() blidly assumes that the ...

Classification

CVE ID: CVE-2024-50002

Affected Products

Vendor: Linux

Product: Linux

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 10.17% (scored less or equal to compared to others)

EPSS Date: 2025-06-02 (when was this score calculated)

Stakeholder-Specific Vulnerability Categorization (SSVC)

SSVC Exploitation: none

SSVC Technical Impact: partial

SSVC Automatable: false

References

https://nvd.nist.gov/vuln/detail/CVE-2024-50002
https://git.kernel.org/stable/c/ed4c8ce0f307f2ab8778aeb40a8866d171e8f128
https://git.kernel.org/stable/c/b566c7d8a2de403ccc9d8a06195e19bbb386d0e4
https://git.kernel.org/stable/c/c0abbbe8c98c077292221ec7e2baa667c9f0974c
https://git.kernel.org/stable/c/2b494471797bff3d257e99dc0a7abb0c5ff3b4cd
https://git.kernel.org/stable/c/9c48c2b53191bf991361998f5bb97b8f2fc5a89c
https://git.kernel.org/stable/c/4b30051c4864234ec57290c3d142db7c88f10d8a

Timeline