CVE-2026-72028
2026-08-15
06h21 +00:00
06h21 +00:00
Thông báo cho một CVE
Luôn được thông báo về mọi thay đổi đối với một CVE cụ thể.
Mô tả CVE
In the Linux kernel, the following vulnerability has been resolved:
riscv: probes: save original sp in rethook trampoline
Reading a word from the stack in a kretprobe crashes a risc-v kernel.
$ cd /sys/kernel/tracing/
$ echo 'r n_tty_write $stack0' > dynamic_events
$ echo 1 > events/kprobes/enable
Unable to handle kernel paging request at virtual address 0000000200000128
...
[] regs_get_kernel_stack_nth+0x26/0x38
[] process_fetch_insn+0x3ee/0x760
[] kretprobe_trace_func+0x116/0x1f0
[] kretprobe_dispatcher+0x4a/0x58
[] kretprobe_rethook_handler+0x5e/0x90
[] rethook_trampoline_handler+0x70/0x108
[] arch_rethook_trampoline_callback+0x12/0x1c
[] arch_rethook_trampoline+0x48/0x94
[] tty_write+0x1a/0x30
In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value.
arch_rethook_trampoline saves the registers from the probed function in a
struct pt_regs. sp is not saved. Instead, sp is decremented for
arch_rethook_trampoline's local stack.
Fix this crash and save the original sp along with the other registers.
Use a0 as a temporary register, it is overwritten anyway.
[pjw@kernel.org: added Fixes tag; cc'ed stable]
