In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
futex\/pi: Plug private futex exec() race<\/p>\n
The check for private futexes whether the waiter’s mm, which is stored in
\nthe futex_key and copied into the pi_state, is the same as the owner’s mm
\nis not sufficient for exec(). exec() has a gap where the mm check fails to
\ngive the correct answer:<\/p>\n
exec()
\n …
\n exec_release_mm()
\n futex_exec_release()
\n tsk::futex::exit_state = EXITING;
\n cleanup_robust_list();
\n1) tsk::futex::exit_state = OK;
\n …
\n old_mm = tsk::mm;
\n2) tsk::mm = ->mm;<\/p>\n
Between #1 and #2 the check for the mm is wrong as that mm is about to be
\nswapped out and eventually freed.<\/p>\n
Plug this gap by:<\/p>\n
1) Setting tsk::futex::exit_state to FUTEX_STATE_DEAD in
\n futex_exec_release()<\/p>\n
2) Setting tsk::futex::exit_state to FUTEX_STATE_OK after
\n the mm has been switched.<\/p>\n
From a futex point of view the task is dead after it finished the robust
\nlist cleanup up to the point where it sets the state to OK again.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
futex\/pi: Plug private futex exec() race<\/p>\n
The check for private futexes whether the waiter’s mm, which is stored in
\nthe futex_key a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17281","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17281","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}