| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-43869: perf: Fix event leak upon exec and file release |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| perf: Fix event leak upon exec and file release |
| |
| The perf pending task work is never waited upon the matching event |
| release. In the case of a child event, released via free_event() |
| directly, this can potentially result in a leaked event, such as in the |
| following scenario that doesn't even require a weak IRQ work |
| implementation to trigger: |
| |
| schedule() |
| prepare_task_switch() |
| =======> <NMI> |
| perf_event_overflow() |
| event->pending_sigtrap = ... |
| irq_work_queue(&event->pending_irq) |
| <======= </NMI> |
| perf_event_task_sched_out() |
| event_sched_out() |
| event->pending_sigtrap = 0; |
| atomic_long_inc_not_zero(&event->refcount) |
| task_work_add(&event->pending_task) |
| finish_lock_switch() |
| =======> <IRQ> |
| perf_pending_irq() |
| //do nothing, rely on pending task work |
| <======= </IRQ> |
| |
| begin_new_exec() |
| perf_event_exit_task() |
| perf_event_exit_event() |
| // If is child event |
| free_event() |
| WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1) |
| // event is leaked |
| |
| Similar scenarios can also happen with perf_event_remove_on_exec() or |
| simply against concurrent perf_event_release(). |
| |
| Fix this with synchonizing against the possibly remaining pending task |
| work while freeing the event, just like is done with remaining pending |
| IRQ work. This means that the pending task callback neither need nor |
| should hold a reference to the event, preventing it from ever beeing |
| freed. |
| |
| The Linux kernel CVE team has assigned CVE-2024-43869 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.15.84 with commit 8bffa95ac19ff27c8261904f89d36c7fcf215d59 and fixed in 5.15.165 with commit 9ad46f1fef421d43cdab3a7d1744b2f43b54dae0 |
| Issue introduced in 6.1 with commit 517e6a301f34613bff24a8e35b5455884f2d83d8 and fixed in 6.1.103 with commit ed2c202dac55423a52d7e2290f2888bf08b8ee99 |
| Issue introduced in 6.1 with commit 517e6a301f34613bff24a8e35b5455884f2d83d8 and fixed in 6.6.44 with commit 104e258a004037bc7dba9f6085c71dad6af57ad4 |
| Issue introduced in 6.1 with commit 517e6a301f34613bff24a8e35b5455884f2d83d8 and fixed in 6.10.3 with commit f34d8307a73a18de5320fcc6f40403146d061891 |
| Issue introduced in 6.1 with commit 517e6a301f34613bff24a8e35b5455884f2d83d8 and fixed in 6.11 with commit 3a5465418f5fd970e86a86c7f4075be262682840 |
| Issue introduced in 6.0.14 with commit 78e1317a174edbfd1182599bf76c092a2877672c |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-43869 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| include/linux/perf_event.h |
| kernel/events/core.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/9ad46f1fef421d43cdab3a7d1744b2f43b54dae0 |
| https://git.kernel.org/stable/c/ed2c202dac55423a52d7e2290f2888bf08b8ee99 |
| https://git.kernel.org/stable/c/104e258a004037bc7dba9f6085c71dad6af57ad4 |
| https://git.kernel.org/stable/c/f34d8307a73a18de5320fcc6f40403146d061891 |
| https://git.kernel.org/stable/c/3a5465418f5fd970e86a86c7f4075be262682840 |
