Homepage

Use After Free Affecting kernel-debuginfo-common-x86_64 package, versions <0:6.1.130-139.222.amzn2023

Severity

 Recommended
high

Based on Amazon Linux security rating.

Threat Intelligence

EPSS
0.04% (11th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Use After Free vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-AMZN2023-KERNELDEBUGINFOCOMMONX8664-10495669
  • published24 Jun 2025
  • disclosed1 Apr 2025
Report a new vulnerability Found a mistake?

Introduced: 1 Apr 2025

CVE-2025-21899  (opens in a new tab)
CWE-416  (opens in a new tab)

How to fix?

Upgrade Amazon-Linux:2023 kernel-debuginfo-common-x86_64 to version 0:6.1.130-139.222.amzn2023 or higher.
This issue was patched in ALAS2023-2025-901.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-debuginfo-common-x86_64 package and not the kernel-debuginfo-common-x86_64 package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2023 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix bad hist from corrupting named_triggers list

The following commands causes a crash:

~# cd /sys/kernel/tracing/events/rcu/rcu_callback ~# echo 'hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)' > trigger bash: echo: write error: Invalid argument ~# echo 'hist:name=bad:keys=common_pid' > trigger

Because the following occurs:

event_trigger_write() { trigger_process_regex() { event_hist_trigger_parse() {

  data = event_trigger_alloc(..);


  event_trigger_register(.., data) {
    cmd_ops-&gt;reg(.., data, ..) [hist_register_trigger()] {
      data-&gt;ops-&gt;init() [event_hist_trigger_init()] {
        save_named_trigger(name, data) {
          list_add(&amp;data-&gt;named_list, &amp;named_triggers);
        }
      }
    }
  }


  ret = create_actions(); (return -EINVAL)
  if (ret)
    goto out_unreg;

[..] ret = hist_trigger_enable(data, ...) { list_add_tail_rcu(&data->list, &file->triggers); <<<---- SKIPPED!!! (this is important!) [..] out_unreg: event_hist_unregister(.., data) { cmd_ops->unreg(.., data, ..) [hist_unregister_trigger()] { list_for_each_entry(iter, &file->triggers, list) { if (!hist_trigger_match(data, iter, named_data, false)) <- never matches continue; [..] test = iter; } if (test && test->ops->free) <<<-- test is NULL

        test-&gt;ops-&gt;free(test) [event_hist_trigger_free()] {
          [..]
          if (data-&gt;name)
            del_named_trigger(data) {
              list_del(&amp;data-&gt;named_list);  &lt;&lt;&lt;&lt;-- NEVER gets removed!
            }
          }
       }
     }


 [..]
 kfree(data); &amp;lt;&amp;lt;&amp;lt;-- frees item but it is still on list

The next time a hist with name is registered, it causes an u-a-f bug and the kernel can crash.

Move the code around such that if event_trigger_register() succeeds, the next thing called is hist_trigger_enable() which adds it to the list.

A bunch of actions is called if get_named_trigger_data() returns false. But that doesn't need to be called after event_trigger_register(), so it can be moved up, allowing event_trigger_register() to be called just before hist_trigger_enable() keeping them together and allowing the file->triggers to be properly populated.

CVSS Base Scores

version 3.1