In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tracing: Fix use-after-free with same-name named triggers<\/p>\n
When two hist triggers on different events are registered with the same
\nname=, the second one reuses the first as named_data. Both are added to
\ntr->hist_vars by save_hist_vars() during event_hist_trigger_parse(),
\nbecause save_hist_vars() is called before event_trigger_register() while
\nthe named reuse is only detected later, in hist_register_trigger().<\/p>\n
In the named-data branch hist_register_trigger() then frees the second
\nhistogram’s hist_data via destroy_hist_data(), but never removes its
\ntr->hist_vars list entry, leaving a dangling pointer and leaking the
\ntrace_array reference it holds.<\/p>\n
A later hist trigger that references a variable makes find_var_file()
\nwalk tr->hist_vars and dereference the freed hist_data. The bug is
\nreproducible from userspace by writing three hist triggers to tracefs:<\/p>\n
cd \/sys\/kernel\/tracing
\n echo ‘hist:keys=common_pid:x=common_pid:name=mh’ > events\/sched\/sched_switch\/trigger
\n echo ‘hist:keys=common_pid:x=common_pid:name=mh’ > events\/sched\/sched_process_fork\/trigger
\n echo ‘hist:keys=common_pid:vals=$x’ > events\/sched\/sched_process_exit\/trigger<\/p>\n
The third write panics the kernel:<\/p>\n
BUG: KASAN: slab-use-after-free in find_var_file.part.0+0x272\/0x290
\n Read of size 8 at addr ffff888001f8a0e0 by task sh\/1
\n CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G D N
\n Call Trace:
\n find_var_file.part.0
\n find_event_var
\n parse_atom
\n parse_expr
\n __create_val_field
\n event_hist_trigger_parse
\n trigger_process_regex
\n event_trigger_write
\n vfs_write
\n ksys_write
\n do_syscall_64
\n entry_SYSCALL_64_after_hwframe
\n Allocated by task 1:
\n event_hist_trigger_parse
\n Freed by task 1:
\n hist_register_trigger+0x618\/0xa30
\n event_hist_trigger_parse
\n The buggy address belongs to freed 2048-byte region
\n Oops: general protection fault … RIP: find_var_file.part.0
\n Kernel panic – not syncing: Attempted to kill init! exitcode=0x0000000b<\/p>\n
Fix by removing the hist_data from tr->hist_vars and releasing the
\ntrace_array reference in the named-data branch of hist_register_trigger()
\nbefore freeing the hist_data.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tracing: Fix use-after-free with same-name named triggers<\/p>\n
When two hist triggers on different events are registered with the same<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21668","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21668","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}