CVE-2026-72028
2026-08-15
06h21 +00:00
06h21 +00:00
特定のCVEの通知
特定のCVEの変更情報をいち早くお届けします。
CVE の説明
In the Linux kernel, the following vulnerability has been resolved:
riscv: probes: save original sp in rethook trampoline
Reading a word from the stack in a kretprobe crashes a risc-v kernel.
$ cd /sys/kernel/tracing/
$ echo 'r n_tty_write $stack0' > dynamic_events
$ echo 1 > events/kprobes/enable
Unable to handle kernel paging request at virtual address 0000000200000128
...
[] regs_get_kernel_stack_nth+0x26/0x38
[] process_fetch_insn+0x3ee/0x760
[] kretprobe_trace_func+0x116/0x1f0
[] kretprobe_dispatcher+0x4a/0x58
[] kretprobe_rethook_handler+0x5e/0x90
[] rethook_trampoline_handler+0x70/0x108
[] arch_rethook_trampoline_callback+0x12/0x1c
[] arch_rethook_trampoline+0x48/0x94
[] tty_write+0x1a/0x30
In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value.
arch_rethook_trampoline saves the registers from the probed function in a
struct pt_regs. sp is not saved. Instead, sp is decremented for
arch_rethook_trampoline's local stack.
Fix this crash and save the original sp along with the other registers.
Use a0 as a temporary register, it is overwritten anyway.
[pjw@kernel.org: added Fixes tag; cc'ed stable]
