| From bippy-1.1.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-49782: perf: Improve missing SIGTRAP checking |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| perf: Improve missing SIGTRAP checking |
| |
| To catch missing SIGTRAP we employ a WARN in __perf_event_overflow(), |
| which fires if pending_sigtrap was already set: returning to user space |
| without consuming pending_sigtrap, and then having the event fire again |
| would re-enter the kernel and trigger the WARN. |
| |
| This, however, seemed to miss the case where some events not associated |
| with progress in the user space task can fire and the interrupt handler |
| runs before the IRQ work meant to consume pending_sigtrap (and generate |
| the SIGTRAP). |
| |
| syzbot gifted us this stack trace: |
| |
| | WARNING: CPU: 0 PID: 3607 at kernel/events/core.c:9313 __perf_event_overflow |
| | Modules linked in: |
| | CPU: 0 PID: 3607 Comm: syz-executor100 Not tainted 6.1.0-rc2-syzkaller-00073-g88619e77b33d #0 |
| | Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 |
| | RIP: 0010:__perf_event_overflow+0x498/0x540 kernel/events/core.c:9313 |
| | <...> |
| | Call Trace: |
| | <TASK> |
| | perf_swevent_hrtimer+0x34f/0x3c0 kernel/events/core.c:10729 |
| | __run_hrtimer kernel/time/hrtimer.c:1685 [inline] |
| | __hrtimer_run_queues+0x1c6/0xfb0 kernel/time/hrtimer.c:1749 |
| | hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811 |
| | local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1096 [inline] |
| | __sysvec_apic_timer_interrupt+0x17c/0x640 arch/x86/kernel/apic/apic.c:1113 |
| | sysvec_apic_timer_interrupt+0x40/0xc0 arch/x86/kernel/apic/apic.c:1107 |
| | asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649 |
| | <...> |
| | </TASK> |
| |
| In this case, syzbot produced a program with event type |
| PERF_TYPE_SOFTWARE and config PERF_COUNT_SW_CPU_CLOCK. The hrtimer |
| manages to fire again before the IRQ work got a chance to run, all while |
| never having returned to user space. |
| |
| Improve the WARN to check for real progress in user space: approximate |
| this by storing a 32-bit hash of the current IP into pending_sigtrap, |
| and if an event fires while pending_sigtrap still matches the previous |
| IP, we assume no progress (false negatives are possible given we could |
| return to user space and trigger again on the same IP). |
| |
| The Linux kernel CVE team has assigned CVE-2022-49782 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.15.77 with commit ca7b0a10287e2733bdafb01ef0d4038536625fe3 and fixed in 5.15.80 with commit 35c60b4e8ca76712dd03bafe2598e31578248916 |
| Issue introduced in 6.0.7 with commit 078c12ccf1fb943cc18c84894c76113dc89e5975 and fixed in 6.0.10 with commit b09221f1b4944d2866d06ac35e59d7a6f8916c9f |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-49782 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| kernel/events/core.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/35c60b4e8ca76712dd03bafe2598e31578248916 |
| https://git.kernel.org/stable/c/b09221f1b4944d2866d06ac35e59d7a6f8916c9f |
| https://git.kernel.org/stable/c/bb88f9695460bec25aa30ba9072595025cf6c8af |
