GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-38588 (GCVE-0-2024-38588)

Vulnerability from cvelistv5 – Published: 2024-06-19 13:37 – Updated: 2026-08-05 11:33
VLAI
Title
ftrace: Fix possible use-after-free issue in ftrace_location()
Summary
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix possible use-after-free issue in ftrace_location() KASAN reports a bug: BUG: KASAN: use-after-free in ftrace_location+0x90/0x120 Read of size 8 at addr ffff888141d40010 by task insmod/424 CPU: 8 PID: 424 Comm: insmod Tainted: G W 6.9.0-rc2+ [...] Call Trace: <TASK> dump_stack_lvl+0x68/0xa0 print_report+0xcf/0x610 kasan_report+0xb5/0xe0 ftrace_location+0x90/0x120 register_kprobe+0x14b/0xa40 kprobe_init+0x2d/0xff0 [kprobe_example] do_one_initcall+0x8f/0x2d0 do_init_module+0x13a/0x3c0 load_module+0x3082/0x33d0 init_module_from_file+0xd2/0x130 __x64_sys_finit_module+0x306/0x440 do_syscall_64+0x68/0x140 entry_SYSCALL_64_after_hwframe+0x71/0x79 The root cause is that, in lookup_rec(), ftrace record of some address is being searched in ftrace pages of some module, but those ftrace pages at the same time is being freed in ftrace_release_mod() as the corresponding module is being deleted: CPU1 | CPU2 register_kprobes() { | delete_module() { check_kprobe_address_safe() { | arch_check_ftrace_location() { | ftrace_location() { | lookup_rec() // USE! | ftrace_release_mod() // Free! To fix this issue: 1. Hold rcu lock as accessing ftrace pages in ftrace_location_range(); 2. Use ftrace_location_range() instead of lookup_rec() in ftrace_location(); 3. Call synchronize_rcu() before freeing any ftrace pages both in ftrace_process_locs()/ftrace_release_mod()/ftrace_free_mem().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-30 19:17 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b , < eea46baf145150910ba134f75a67106ba2222c1b (git)
Affected: ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b , < 1880a324af1c95940a7c954b6b937e86844a33bd (git)
Affected: ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b , < 8ea8ef5e42173560ac510e92a1cc797ffeea8831 (git)
Affected: ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b , < dbff5f0bfb2416b8b55c105ddbcd4f885e98fada (git)
Affected: ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b , < 7b4881da5b19f65709f5c18c1a4d8caa2e496461 (git)
Affected: ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b , < 66df065b3106964e667b37bf8f7e55ec69d0c1f6 (git)
Affected: ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b , < 31310e373f4c8c74e029d4326b283e757edabc0b (git)
Affected: ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b , < e60b613df8b6253def41215402f72986fee3fc8d (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.7
Unaffected: 0 , < 3.7 (semver)
Unaffected: 5.4.286 , ≤ 5.4.* (semver)
Unaffected: 5.10.227 , ≤ 5.10.* (semver)
Unaffected: 5.15.162 , ≤ 5.15.* (semver)
Unaffected: 6.1.93 , ≤ 6.1.* (semver)
Unaffected: 6.6.33 , ≤ 6.6.* (semver)
Unaffected: 6.8.12 , ≤ 6.8.* (semver)
Unaffected: 6.9.3 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-38588",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-30T19:17:19.872138Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-30T19:18:45.225Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:38:10.030Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8ea8ef5e42173560ac510e92a1cc797ffeea8831"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dbff5f0bfb2416b8b55c105ddbcd4f885e98fada"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7b4881da5b19f65709f5c18c1a4d8caa2e496461"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/66df065b3106964e667b37bf8f7e55ec69d0c1f6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/31310e373f4c8c74e029d4326b283e757edabc0b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e60b613df8b6253def41215402f72986fee3fc8d"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ftrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eea46baf145150910ba134f75a67106ba2222c1b",
              "status": "affected",
              "version": "ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b",
              "versionType": "git"
            },
            {
              "lessThan": "1880a324af1c95940a7c954b6b937e86844a33bd",
              "status": "affected",
              "version": "ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b",
              "versionType": "git"
            },
            {
              "lessThan": "8ea8ef5e42173560ac510e92a1cc797ffeea8831",
              "status": "affected",
              "version": "ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b",
              "versionType": "git"
            },
            {
              "lessThan": "dbff5f0bfb2416b8b55c105ddbcd4f885e98fada",
              "status": "affected",
              "version": "ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b",
              "versionType": "git"
            },
            {
              "lessThan": "7b4881da5b19f65709f5c18c1a4d8caa2e496461",
              "status": "affected",
              "version": "ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b",
              "versionType": "git"
            },
            {
              "lessThan": "66df065b3106964e667b37bf8f7e55ec69d0c1f6",
              "status": "affected",
              "version": "ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b",
              "versionType": "git"
            },
            {
              "lessThan": "31310e373f4c8c74e029d4326b283e757edabc0b",
              "status": "affected",
              "version": "ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b",
              "versionType": "git"
            },
            {
              "lessThan": "e60b613df8b6253def41215402f72986fee3fc8d",
              "status": "affected",
              "version": "ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ftrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.286",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.286",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.227",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.162",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix possible use-after-free issue in ftrace_location()\n\nKASAN reports a bug:\n\n  BUG: KASAN: use-after-free in ftrace_location+0x90/0x120\n  Read of size 8 at addr ffff888141d40010 by task insmod/424\n  CPU: 8 PID: 424 Comm: insmod Tainted: G        W          6.9.0-rc2+\n  [...]\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x68/0xa0\n   print_report+0xcf/0x610\n   kasan_report+0xb5/0xe0\n   ftrace_location+0x90/0x120\n   register_kprobe+0x14b/0xa40\n   kprobe_init+0x2d/0xff0 [kprobe_example]\n   do_one_initcall+0x8f/0x2d0\n   do_init_module+0x13a/0x3c0\n   load_module+0x3082/0x33d0\n   init_module_from_file+0xd2/0x130\n   __x64_sys_finit_module+0x306/0x440\n   do_syscall_64+0x68/0x140\n   entry_SYSCALL_64_after_hwframe+0x71/0x79\n\nThe root cause is that, in lookup_rec(), ftrace record of some address\nis being searched in ftrace pages of some module, but those ftrace pages\nat the same time is being freed in ftrace_release_mod() as the\ncorresponding module is being deleted:\n\n           CPU1                       |      CPU2\n  register_kprobes() {                | delete_module() {\n    check_kprobe_address_safe() {     |\n      arch_check_ftrace_location() {  |\n        ftrace_location() {           |\n          lookup_rec() // USE!        |   ftrace_release_mod() // Free!\n\nTo fix this issue:\n  1. Hold rcu lock as accessing ftrace pages in ftrace_location_range();\n  2. Use ftrace_location_range() instead of lookup_rec() in\n     ftrace_location();\n  3. Call synchronize_rcu() before freeing any ftrace pages both in\n     ftrace_process_locs()/ftrace_release_mod()/ftrace_free_mem()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Both sides of the race are driven through local syscalls \u2014 `finit_module`/`delete_module` (or unprivileged module autoload) on the free side and `perf_event_open`/`bpf()`/tracefs `kprobe_events` on the `ftrace_location()` reader side. There is no remote or adjacent-network path into ftrace page management.\nAC:L - The attacker controls both sides of the race and can loop them concurrently \u2014 repeatedly registering kprobes/fprobes on one CPU while loading/unloading a module on another \u2014 and the window spans the entire unlocked `pg-\u003enext`/bsearch walk, which is why the reporter hit it with a plain `insmod` of the sample kprobe module. `CONFIG_DYNAMIC_FTRACE` is enabled in virtually all production kernels, so no rare configuration is needed.\nPR:L - The reader side is reachable by a low-privileged tracing-capable task (CAP_PERFMON/CAP_BPF, routinely granted to containerised monitoring agents rather than full root), and the free side can be triggered by an unprivileged task via module autoloading (`request_module()` from AF_ALG bind or socket-family aliases) as well as by module load/unload. No full init-namespace root is required for the whole chain.\nUI:N - The attacker triggers both the kprobe/ftrace registration and the module load/unload entirely on their own; no victim action or cooperation is involved.\nS:U - The use-after-free is in kernel heap/page memory and its consequences stay within the kernel\u0027s own security authority \u2014 no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `lookup_rec()` reads freed `struct ftrace_page` objects and freed record pages, and the harvested contents (`rec-\u003eip`) are returned to the caller and observable through kprobe/ftrace state, exposing whatever reallocated kernel data now occupies those pages.\nI:H - The address returned from freed memory is consumed as a code-patching target \u2014 stored as `tr-\u003eip` for BPF trampolines and installed into ftrace filter hashes \u2014 so heap spraying of the reclaimed pages can steer kernel text modification to an attacker-chosen address, giving a write/control-flow-hijack primitive.\nA:H - Traversing the freed `pg-\u003enext` list and bsearching freed record pages dereferences wild pointers, producing an oops or panic; the race can be retried indefinitely to force a crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:33:01.142Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eea46baf145150910ba134f75a67106ba2222c1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1880a324af1c95940a7c954b6b937e86844a33bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ea8ef5e42173560ac510e92a1cc797ffeea8831"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbff5f0bfb2416b8b55c105ddbcd4f885e98fada"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b4881da5b19f65709f5c18c1a4d8caa2e496461"
        },
        {
          "url": "https://git.kernel.org/stable/c/66df065b3106964e667b37bf8f7e55ec69d0c1f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/31310e373f4c8c74e029d4326b283e757edabc0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e60b613df8b6253def41215402f72986fee3fc8d"
        }
      ],
      "title": "ftrace: Fix possible use-after-free issue in ftrace_location()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38588",
    "datePublished": "2024-06-19T13:37:43.262Z",
    "dateReserved": "2024-06-18T19:36:34.929Z",
    "dateUpdated": "2026-08-05T11:33:01.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-38588",
      "date": "2026-09-16",
      "epss": "0.00237",
      "percentile": "0.14906"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.7\", \"versionEndExcluding\": \"6.1.93\", \"matchCriteriaId\": \"40927E07-D355-4FC7-8DC6-C969BC9C7CE6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.33\", \"matchCriteriaId\": \"FCE796DF-3B50-4DC6-BAE5-95271068FC9E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.8.12\", \"matchCriteriaId\": \"80550309-67AB-4FD1-AC07-3DED5C4F01B2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.9\", \"versionEndExcluding\": \"6.9.3\", \"matchCriteriaId\": \"E07124C1-19E8-4D21-828D-9932A01D3011\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nftrace: Fix possible use-after-free issue in ftrace_location()\\n\\nKASAN reports a bug:\\n\\n  BUG: KASAN: use-after-free in ftrace_location+0x90/0x120\\n  Read of size 8 at addr ffff888141d40010 by task insmod/424\\n  CPU: 8 PID: 424 Comm: insmod Tainted: G        W          6.9.0-rc2+\\n  [...]\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x68/0xa0\\n   print_report+0xcf/0x610\\n   kasan_report+0xb5/0xe0\\n   ftrace_location+0x90/0x120\\n   register_kprobe+0x14b/0xa40\\n   kprobe_init+0x2d/0xff0 [kprobe_example]\\n   do_one_initcall+0x8f/0x2d0\\n   do_init_module+0x13a/0x3c0\\n   load_module+0x3082/0x33d0\\n   init_module_from_file+0xd2/0x130\\n   __x64_sys_finit_module+0x306/0x440\\n   do_syscall_64+0x68/0x140\\n   entry_SYSCALL_64_after_hwframe+0x71/0x79\\n\\nThe root cause is that, in lookup_rec(), ftrace record of some address\\nis being searched in ftrace pages of some module, but those ftrace pages\\nat the same time is being freed in ftrace_release_mod() as the\\ncorresponding module is being deleted:\\n\\n           CPU1                       |      CPU2\\n  register_kprobes() {                | delete_module() {\\n    check_kprobe_address_safe() {     |\\n      arch_check_ftrace_location() {  |\\n        ftrace_location() {           |\\n          lookup_rec() // USE!        |   ftrace_release_mod() // Free!\\n\\nTo fix this issue:\\n  1. Hold rcu lock as accessing ftrace pages in ftrace_location_range();\\n  2. Use ftrace_location_range() instead of lookup_rec() in\\n     ftrace_location();\\n  3. Call synchronize_rcu() before freeing any ftrace pages both in\\n     ftrace_process_locs()/ftrace_release_mod()/ftrace_free_mem().\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ftrace: Solucionar posible problema de use-after-free en ftrace_location() KASAN informa un error: ERROR: KASAN: use-after-free en ftrace_location+0x90/0x120 Lectura de tama\\u00f1o 8 en addr ffff888141d40010 por tarea insmod/424 CPU: 8 PID: 424 Comm: insmod Tainted: GW 6.9.0-rc2+ [...] Rastreo de llamadas:  dump_stack_lvl+0x68/0xa0 print_report+0xcf/0x610 kasan_report+0xb5/ 0xe0 ftrace_location+0x90/0x120 Register_kprobe+0x14b/0xa40 kprobe_init+0x2d/0xff0 [kprobe_example] do_one_initcall+0x8f/0x2d0 do_init_module+0x13a/0x3c0 load_module+0x3082/0x33d0 init_module_from _file+0xd2/0x130 __x64_sys_finit_module+0x306/0x440 do_syscall_64+0x68/0x140 entrada_SYSCALL_64_after_hwframe +0x71/0x79 La causa principal es que, en lookup_rec(), el registro ftrace de alguna direcci\\u00f3n se busca en las p\\u00e1ginas ftrace de alg\\u00fan m\\u00f3dulo, pero esas p\\u00e1ginas ftrace al mismo tiempo se liberan en ftrace_release_mod() como lo est\\u00e1 el m\\u00f3dulo correspondiente. siendo eliminado: CPU1 | CPU2 registro_kprobes() { | eliminar_m\\u00f3dulo() { check_kprobe_address_safe() { | arch_check_ftrace_location() { | ftrace_ubicaci\\u00f3n() { | lookup_rec() // \\u00a1UTILIZAR! | ftrace_release_mod() // \\u00a1Gratis! Para solucionar este problema: 1. Mantenga presionado rcu lock mientras accede a las p\\u00e1ginas de ftrace en ftrace_location_range(); 2. Utilice ftrace_location_range() en lugar de lookup_rec() en ftrace_location(); 3. Llame a sincronizar_rcu() antes de liberar cualquier p\\u00e1gina ftrace tanto en ftrace_process_locs()/ftrace_release_mod()/ftrace_free_mem().\"}]",
      "id": "CVE-2024-38588",
      "lastModified": "2024-11-21T09:26:25.347",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-06-19T14:15:18.907",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/1880a324af1c95940a7c954b6b937e86844a33bd\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/31310e373f4c8c74e029d4326b283e757edabc0b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/66df065b3106964e667b37bf8f7e55ec69d0c1f6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7b4881da5b19f65709f5c18c1a4d8caa2e496461\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8ea8ef5e42173560ac510e92a1cc797ffeea8831\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/dbff5f0bfb2416b8b55c105ddbcd4f885e98fada\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e60b613df8b6253def41215402f72986fee3fc8d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/eea46baf145150910ba134f75a67106ba2222c1b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/31310e373f4c8c74e029d4326b283e757edabc0b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/66df065b3106964e667b37bf8f7e55ec69d0c1f6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7b4881da5b19f65709f5c18c1a4d8caa2e496461\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8ea8ef5e42173560ac510e92a1cc797ffeea8831\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/dbff5f0bfb2416b8b55c105ddbcd4f885e98fada\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e60b613df8b6253def41215402f72986fee3fc8d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T01:27:29.000Z",
      "cve": "CVE-2024-38588",
      "id": "msrc_CVE-2024-38588",
      "initial_release_date": "2024-06-02T07:00:00.000Z",
      "product_status:fixed": "3",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ftrace: Fix possible use-after-free issue in ftrace_location()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-38588.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-38588\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-19T14:15:18.907\",\"lastModified\":\"2026-06-17T07:40:39.173\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nftrace: Fix possible use-after-free issue in ftrace_location()\\n\\nKASAN reports a bug:\\n\\n  BUG: KASAN: use-after-free in ftrace_location+0x90/0x120\\n  Read of size 8 at addr ffff888141d40010 by task insmod/424\\n  CPU: 8 PID: 424 Comm: insmod Tainted: G        W          6.9.0-rc2+\\n  [...]\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x68/0xa0\\n   print_report+0xcf/0x610\\n   kasan_report+0xb5/0xe0\\n   ftrace_location+0x90/0x120\\n   register_kprobe+0x14b/0xa40\\n   kprobe_init+0x2d/0xff0 [kprobe_example]\\n   do_one_initcall+0x8f/0x2d0\\n   do_init_module+0x13a/0x3c0\\n   load_module+0x3082/0x33d0\\n   init_module_from_file+0xd2/0x130\\n   __x64_sys_finit_module+0x306/0x440\\n   do_syscall_64+0x68/0x140\\n   entry_SYSCALL_64_after_hwframe+0x71/0x79\\n\\nThe root cause is that, in lookup_rec(), ftrace record of some address\\nis being searched in ftrace pages of some module, but those ftrace pages\\nat the same time is being freed in ftrace_release_mod() as the\\ncorresponding module is being deleted:\\n\\n           CPU1                       |      CPU2\\n  register_kprobes() {                | delete_module() {\\n    check_kprobe_address_safe() {     |\\n      arch_check_ftrace_location() {  |\\n        ftrace_location() {           |\\n          lookup_rec() // USE!        |   ftrace_release_mod() // Free!\\n\\nTo fix this issue:\\n  1. Hold rcu lock as accessing ftrace pages in ftrace_location_range();\\n  2. Use ftrace_location_range() instead of lookup_rec() in\\n     ftrace_location();\\n  3. Call synchronize_rcu() before freeing any ftrace pages both in\\n     ftrace_process_locs()/ftrace_release_mod()/ftrace_free_mem().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ftrace: Solucionar posible problema de use-after-free en ftrace_location() KASAN informa un error: ERROR: KASAN: use-after-free en ftrace_location+0x90/0x120 Lectura de tama\u00f1o 8 en addr ffff888141d40010 por tarea insmod/424 CPU: 8 PID: 424 Comm: insmod Tainted: GW 6.9.0-rc2+ [...] Rastreo de llamadas:  dump_stack_lvl+0x68/0xa0 print_report+0xcf/0x610 kasan_report+0xb5/ 0xe0 ftrace_location+0x90/0x120 Register_kprobe+0x14b/0xa40 kprobe_init+0x2d/0xff0 [kprobe_example] do_one_initcall+0x8f/0x2d0 do_init_module+0x13a/0x3c0 load_module+0x3082/0x33d0 init_module_from _file+0xd2/0x130 __x64_sys_finit_module+0x306/0x440 do_syscall_64+0x68/0x140 entrada_SYSCALL_64_after_hwframe +0x71/0x79 La causa principal es que, en lookup_rec(), el registro ftrace de alguna direcci\u00f3n se busca en las p\u00e1ginas ftrace de alg\u00fan m\u00f3dulo, pero esas p\u00e1ginas ftrace al mismo tiempo se liberan en ftrace_release_mod() como lo est\u00e1 el m\u00f3dulo correspondiente. siendo eliminado: CPU1 | CPU2 registro_kprobes() { | eliminar_m\u00f3dulo() { check_kprobe_address_safe() { | arch_check_ftrace_location() { | ftrace_ubicaci\u00f3n() { | lookup_rec() // \u00a1UTILIZAR! | ftrace_release_mod() // \u00a1Gratis! Para solucionar este problema: 1. Mantenga presionado rcu lock mientras accede a las p\u00e1ginas de ftrace en ftrace_location_range(); 2. Utilice ftrace_location_range() en lugar de lookup_rec() en ftrace_location(); 3. Llame a sincronizar_rcu() antes de liberar cualquier p\u00e1gina ftrace tanto en ftrace_process_locs()/ftrace_release_mod()/ftrace_free_mem().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/ftrace.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b\",\"lessThan\":\"eea46baf145150910ba134f75a67106ba2222c1b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b\",\"lessThan\":\"1880a324af1c95940a7c954b6b937e86844a33bd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b\",\"lessThan\":\"8ea8ef5e42173560ac510e92a1cc797ffeea8831\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b\",\"lessThan\":\"dbff5f0bfb2416b8b55c105ddbcd4f885e98fada\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b\",\"lessThan\":\"7b4881da5b19f65709f5c18c1a4d8caa2e496461\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b\",\"lessThan\":\"66df065b3106964e667b37bf8f7e55ec69d0c1f6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b\",\"lessThan\":\"31310e373f4c8c74e029d4326b283e757edabc0b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b\",\"lessThan\":\"e60b613df8b6253def41215402f72986fee3fc8d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/ftrace.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.286\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.227\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.162\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.93\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.33\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.12\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.3\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-30T19:17:19.872138Z\",\"id\":\"CVE-2024-38588\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.7\",\"versionEndExcluding\":\"5.4.286\",\"matchCriteriaId\":\"AFAB8A5A-6603-45BC-AF57-49E523395C1B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.227\",\"matchCriteriaId\":\"795A3EE6-0CAB-4409-A903-151C94ACECC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.162\",\"matchCriteriaId\":\"10A39ACC-3005-40E8-875C-98A372D1FFD5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.93\",\"matchCriteriaId\":\"EEFB78EE-F990-4197-BF1C-156760A55667\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.33\",\"matchCriteriaId\":\"FCE796DF-3B50-4DC6-BAE5-95271068FC9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.12\",\"matchCriteriaId\":\"80550309-67AB-4FD1-AC07-3DED5C4F01B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.9.3\",\"matchCriteriaId\":\"E07124C1-19E8-4D21-828D-9932A01D3011\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1880a324af1c95940a7c954b6b937e86844a33bd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/31310e373f4c8c74e029d4326b283e757edabc0b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/66df065b3106964e667b37bf8f7e55ec69d0c1f6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7b4881da5b19f65709f5c18c1a4d8caa2e496461\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ea8ef5e42173560ac510e92a1cc797ffeea8831\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dbff5f0bfb2416b8b55c105ddbcd4f885e98fada\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e60b613df8b6253def41215402f72986fee3fc8d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/eea46baf145150910ba134f75a67106ba2222c1b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/31310e373f4c8c74e029d4326b283e757edabc0b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/66df065b3106964e667b37bf8f7e55ec69d0c1f6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7b4881da5b19f65709f5c18c1a4d8caa2e496461\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ea8ef5e42173560ac510e92a1cc797ffeea8831\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dbff5f0bfb2416b8b55c105ddbcd4f885e98fada\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e60b613df8b6253def41215402f72986fee3fc8d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T14:39:39+00:00",
      "cve": "CVE-2024-38588",
      "id": "CVE-2024-38588",
      "initial_release_date": "2024-06-19T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ftrace: Fix possible use-after-free issue in ftrace_location()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-38588.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T17:00:58Z",
      "cve": "CVE-2024-38588",
      "id": "CVE-2024-38588",
      "initial_release_date": "2024-06-24T23:16:03Z",
      "product_status:known_affected": "637",
      "product_status:known_not_affected": "66",
      "product_status:recommended": "688",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-38588",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-38588.json",
      "version": "96"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8ea8ef5e42173560ac510e92a1cc797ffeea8831\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/dbff5f0bfb2416b8b55c105ddbcd4f885e98fada\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7b4881da5b19f65709f5c18c1a4d8caa2e496461\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/66df065b3106964e667b37bf8f7e55ec69d0c1f6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/31310e373f4c8c74e029d4326b283e757edabc0b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e60b613df8b6253def41215402f72986fee3fc8d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:38:10.030Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-38588\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-30T19:17:19.872138Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-20T19:45:32.765Z\"}}], \"cna\": {\"title\": \"ftrace: Fix possible use-after-free issue in ftrace_location()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Both sides of the race are driven through local syscalls \\u2014 `finit_module`/`delete_module` (or unprivileged module autoload) on the free side and `perf_event_open`/`bpf()`/tracefs `kprobe_events` on the `ftrace_location()` reader side. There is no remote or adjacent-network path into ftrace page management.\\nAC:L - The attacker controls both sides of the race and can loop them concurrently \\u2014 repeatedly registering kprobes/fprobes on one CPU while loading/unloading a module on another \\u2014 and the window spans the entire unlocked `pg-\u003enext`/bsearch walk, which is why the reporter hit it with a plain `insmod` of the sample kprobe module. `CONFIG_DYNAMIC_FTRACE` is enabled in virtually all production kernels, so no rare configuration is needed.\\nPR:L - The reader side is reachable by a low-privileged tracing-capable task (CAP_PERFMON/CAP_BPF, routinely granted to containerised monitoring agents rather than full root), and the free side can be triggered by an unprivileged task via module autoloading (`request_module()` from AF_ALG bind or socket-family aliases) as well as by module load/unload. No full init-namespace root is required for the whole chain.\\nUI:N - The attacker triggers both the kprobe/ftrace registration and the module load/unload entirely on their own; no victim action or cooperation is involved.\\nS:U - The use-after-free is in kernel heap/page memory and its consequences stay within the kernel\u0027s own security authority \\u2014 no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - `lookup_rec()` reads freed `struct ftrace_page` objects and freed record pages, and the harvested contents (`rec-\u003eip`) are returned to the caller and observable through kprobe/ftrace state, exposing whatever reallocated kernel data now occupies those pages.\\nI:H - The address returned from freed memory is consumed as a code-patching target \\u2014 stored as `tr-\u003eip` for BPF trampolines and installed into ftrace filter hashes \\u2014 so heap spraying of the reclaimed pages can steer kernel text modification to an attacker-chosen address, giving a write/control-flow-hijack primitive.\\nA:H - Traversing the freed `pg-\u003enext` list and bsearching freed record pages dereferences wild pointers, producing an oops or panic; the race can be retried indefinitely to force a crash.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b\", \"lessThan\": \"eea46baf145150910ba134f75a67106ba2222c1b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b\", \"lessThan\": \"1880a324af1c95940a7c954b6b937e86844a33bd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b\", \"lessThan\": \"8ea8ef5e42173560ac510e92a1cc797ffeea8831\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b\", \"lessThan\": \"dbff5f0bfb2416b8b55c105ddbcd4f885e98fada\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b\", \"lessThan\": \"7b4881da5b19f65709f5c18c1a4d8caa2e496461\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b\", \"lessThan\": \"66df065b3106964e667b37bf8f7e55ec69d0c1f6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b\", \"lessThan\": \"31310e373f4c8c74e029d4326b283e757edabc0b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ae6aa16fdc163afe6b04b6c073ad4ddd4663c03b\", \"lessThan\": \"e60b613df8b6253def41215402f72986fee3fc8d\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/trace/ftrace.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.286\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/trace/ftrace.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/eea46baf145150910ba134f75a67106ba2222c1b\"}, {\"url\": \"https://git.kernel.org/stable/c/1880a324af1c95940a7c954b6b937e86844a33bd\"}, {\"url\": \"https://git.kernel.org/stable/c/8ea8ef5e42173560ac510e92a1cc797ffeea8831\"}, {\"url\": \"https://git.kernel.org/stable/c/dbff5f0bfb2416b8b55c105ddbcd4f885e98fada\"}, {\"url\": \"https://git.kernel.org/stable/c/7b4881da5b19f65709f5c18c1a4d8caa2e496461\"}, {\"url\": \"https://git.kernel.org/stable/c/66df065b3106964e667b37bf8f7e55ec69d0c1f6\"}, {\"url\": \"https://git.kernel.org/stable/c/31310e373f4c8c74e029d4326b283e757edabc0b\"}, {\"url\": \"https://git.kernel.org/stable/c/e60b613df8b6253def41215402f72986fee3fc8d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nftrace: Fix possible use-after-free issue in ftrace_location()\\n\\nKASAN reports a bug:\\n\\n  BUG: KASAN: use-after-free in ftrace_location+0x90/0x120\\n  Read of size 8 at addr ffff888141d40010 by task insmod/424\\n  CPU: 8 PID: 424 Comm: insmod Tainted: G        W          6.9.0-rc2+\\n  [...]\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x68/0xa0\\n   print_report+0xcf/0x610\\n   kasan_report+0xb5/0xe0\\n   ftrace_location+0x90/0x120\\n   register_kprobe+0x14b/0xa40\\n   kprobe_init+0x2d/0xff0 [kprobe_example]\\n   do_one_initcall+0x8f/0x2d0\\n   do_init_module+0x13a/0x3c0\\n   load_module+0x3082/0x33d0\\n   init_module_from_file+0xd2/0x130\\n   __x64_sys_finit_module+0x306/0x440\\n   do_syscall_64+0x68/0x140\\n   entry_SYSCALL_64_after_hwframe+0x71/0x79\\n\\nThe root cause is that, in lookup_rec(), ftrace record of some address\\nis being searched in ftrace pages of some module, but those ftrace pages\\nat the same time is being freed in ftrace_release_mod() as the\\ncorresponding module is being deleted:\\n\\n           CPU1                       |      CPU2\\n  register_kprobes() {                | delete_module() {\\n    check_kprobe_address_safe() {     |\\n      arch_check_ftrace_location() {  |\\n        ftrace_location() {           |\\n          lookup_rec() // USE!        |   ftrace_release_mod() // Free!\\n\\nTo fix this issue:\\n  1. Hold rcu lock as accessing ftrace pages in ftrace_location_range();\\n  2. Use ftrace_location_range() instead of lookup_rec() in\\n     ftrace_location();\\n  3. Call synchronize_rcu() before freeing any ftrace pages both in\\n     ftrace_process_locs()/ftrace_release_mod()/ftrace_free_mem().\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.286\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.227\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.162\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.93\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.33\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.12\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.3\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"3.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:33:01.142Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-38588\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:33:01.142Z\", \"dateReserved\": \"2024-06-18T19:36:34.929Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-19T13:37:43.262Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.