In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tracing\/user_events: Clear copied tracing state before fork duplication<\/p>\n
dup_task_struct() copies user_event_mm from the parent into the child,
\nwithout grabbing a reference to it. user_event_mm_dup() should
\nreplace it, but it leaves that copied pointer unmodified if
\nuser_event_mm_alloc() fails.<\/p>\n
When the child exits, user_event_mm_remove() decrements a reference
\nthe child never owned, which ultimately frees user_event_mm, while
\nthe parent still as a stale pointer to it. This creates a UAF, which
\nKASAN reports as:<\/p>\n
BUG: KASAN: slab-use-after-free in
\n current_user_event_mm+0x51\/0x1d0 Write of size 4 at addr
\n ffff888005010d30 by task init\/44<\/p>\n
Call Trace:<\/p>\n
kasan_report+0xce\/0x100
\n kasan_check_range+0x10f\/0x1e0
\n current_user_event_mm+0x51\/0x1d0
\n user_events_ioctl+0x82e\/0x15c0
\n __x64_sys_ioctl+0x139\/0x1c0
\n do_syscall_64+0xce\/0x450
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f<\/p>\n
Allocated by task 44:
\n __kasan_kmalloc+0x8f\/0xa0
\n __kmalloc_cache_noprof+0x180\/0x3a0
\n user_event_mm_alloc+0x3c\/0x1f0
\n current_user_event_mm+0x88\/0x1d0<\/p>\n
Freed by task 42:
\n __kasan_slab_free+0x43\/0x70
\n kfree+0x13a\/0x390
\n process_one_work+0x696\/0xf90
\n worker_thread+0x420\/0xba0<\/p>\n
The fix simply clears the copied pointer before any possible failure.
\nIn case of failure, the child then has nothing to free.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tracing\/user_events: Clear copied tracing state before fork duplication<\/p>\n
dup_task_struct() copies user_event_mm from the parent int<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21672","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21672","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21672"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21672"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21672"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}