CVE-2025-37845

In the Linux kernel, the following vulnerability has been resolved: tracing: fprobe events: Fix possible UAF on modules Commit ac91052f0ae5 ("tracing: tprobe-events: Fix leakage of module refcount") moved try_module_get() from __find_tracepoint_module_cb() to find_tracepoint() caller, but that introduced a possible UAF because the module can be unloaded before try_module_get(). In this case, the module object should be freed too. Thus, try_module_get() does not only fail but may access to the freed object. To avoid that, try_module_get() in __find_tracepoint_module_cb() again.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/626f01f4d26e8cf92e69c1df53036153c8e98a20	Patch
https://git.kernel.org/stable/c/868df4eb784c3ccc7e4340a9ea993cbbedca167e	Patch
https://git.kernel.org/stable/c/a27d2de2472b1cc7d582ab405d1d5832a80481de	Patch
https://git.kernel.org/stable/c/dd941507a9486252d6fcf11814387666792020f3	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.14:-::::::
	cpe:2.3:o:linux:linux_kernel:6.15:rc1::::::

History

No history.

Information

Published : 2025-05-09 07:16

Updated : 2025-11-17 12:48

NVD link : CVE-2025-37845

Mitre link : CVE-2025-37845

CVE.ORG link : CVE-2025-37845

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-416

Use After Free

{"id": "CVE-2025-37845", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2025-05-09T07:16:05.307", "references": [{"url": "https://git.kernel.org/stable/c/626f01f4d26e8cf92e69c1df53036153c8e98a20", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/868df4eb784c3ccc7e4340a9ea993cbbedca167e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a27d2de2472b1cc7d582ab405d1d5832a80481de", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/dd941507a9486252d6fcf11814387666792020f3", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: fprobe events: Fix possible UAF on modules\n\nCommit ac91052f0ae5 (\"tracing: tprobe-events: Fix leakage of module\nrefcount\") moved try_module_get() from __find_tracepoint_module_cb()\nto find_tracepoint() caller, but that introduced a possible UAF\nbecause the module can be unloaded before try_module_get(). In this\ncase, the module object should be freed too. Thus, try_module_get()\ndoes not only fail but may access to the freed object.\n\nTo avoid that, try_module_get() in __find_tracepoint_module_cb()\nagain."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracing: fprobe events: Fix possible UAF on modules. La confirmaci\u00f3n ac91052f0ae5 (\"tracing: tprobe-events: Fix leakage of module refcount\") traslad\u00f3 try_module_get() de __find_tracepoint_module_cb() al llamador de find_tracepoint(), pero esto introdujo un posible UAF porque el m\u00f3dulo puede descargarse antes que try_module_get(). En este caso, el objeto del m\u00f3dulo tambi\u00e9n deber\u00eda liberarse. Por lo tanto, try_module_get() no solo falla, sino que puede acceder al objeto liberado. Para evitarlo, vuelva a intentar try_module_get() en __find_tracepoint_module_cb()."}], "lastModified": "2025-11-17T12:48:18.933", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7AD01D25-A815-4E20-8715-FB2B50EE7FC2", "versionEndExcluding": "6.12.24", "versionStartIncluding": "6.12.21"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A992E5FB-2832-43F3-BCBF-5AE81D7E5BD7", "versionEndExcluding": "6.13.12", "versionStartIncluding": "6.13.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E7F0901-3C1F-4954-B0AB-4531CB0C37DD", "versionEndExcluding": "6.14.3", "versionStartIncluding": "6.14.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7DE421BA-0600-4401-A175-73CAB6A6FB4E"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}