In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
perf\/core: Fix group leader use-after-free after sibling detach<\/p>\n
perf_group_detach() handles leader and sibling detach differently. When the
\ngroup leader is detached, all siblings are promoted to singleton events and
\ntheir group_leader pointer is reset to themselves. When a sibling is
\ndetached, it is removed from the leader’s sibling_list, but its
\ngroup_leader pointer is left pointing at the old leader.<\/p>\n
That is harmless when the sibling is being closed and freed immediately, as
\nin the DETACH_DEAD path. It is not safe when the sibling is detached but
\nkept alive, such as during CPU hotplug with DETACH_GROUP. In that case the
\nsibling is removed from the context, while its file descriptor can still
\nkeep it alive.<\/p>\n
A typical failing sequence is:<\/p>\n
– A group contains leader L and sibling S.
\n – CPU hot-unplug detaches S with DETACH_GROUP, removing it from
\n L->sibling_list but leaving S->group_leader == L.
\n – L is later closed and freed.
\n – A PERF_IOC_FLAG_GROUP ioctl on S follows S->group_leader and
\n dereferences the freed leader.<\/p>\n
This was reproduced by running the perf event fuzzer, CPU hotplug, and a
\nstress workload concurrently:<\/p>\n
Unable to handle kernel paging request at virtual address 006b6b6b6b6b6cdb
\n CPU: 2 PID: 12489 Comm: perf_fuzzer 6.18.7 PREEMPT
\n pc : perf_ioctl+0x34c\/0xc68
\n x20: ffffff89a3fa2c70 x8 : 6b6b6b6b6b6b6b6b
\n Code: 943c4a0e 340047a0 f9404a94 f9411e88 (f940b908)
\n Call trace:
\n perf_ioctl+0x34c\/0xc68 (P)
\n __arm64_sys_ioctl+0xa0\/0xf4
\n invoke_syscall+0x58\/0xe4
\n el0_svc_common+0xa8\/0xdc
\n do_el0_svc+0x1c\/0x28
\n el0_svc+0x40\/0xc0
\n el0t_64_sync_handler+0x68\/0xdc
\n el0t_64_sync+0x1c4\/0x1c8<\/p>\n
The fault happened in perf_ioctl(), where perf_event_for_each() follows
\nthe stale group_leader pointer and perf_event_for_each_child() then
\ndereferences the freed leader’s context.<\/p>\n
Fix the use-after-free by promoting the detached sibling to a singleton.
\nAlso fix __event_disable() cgroup accounting and event state change.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
perf\/core: Fix group leader use-after-free after sibling detach<\/p>\n
perf_group_detach() handles leader and sibling detach differently.<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11236","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11236","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11236"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11236"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11236"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}