In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
perf: Fix use-after-free when perf mmap() revival races with the last munmap()<\/p>\n
perf_mmap_close() drops rb->mmap_count *without* holding
\nevent->mmap_mutex (the refcount_dec_and_test() right before the
\nrefcount_dec_and_mutex_lock() of event->mmap_count). A concurrent
\nperf_mmap_rb() can slot its entire “revival” path into that window
\n(perf_mmap holds event->mmap_mutex for its whole duration, including
\nrb_alloc):<\/p>\n
munmap side (perf_mmap_close) mmap side (perf_mmap_rb)
\n ———————————– ——————————–
\n rb->mmap_count 1 -> 0 (no lock) (holds event->mmap_mutex)
\n inc_not_zero(rb->mmap_count) fails
\n ring_buffer_attach(event, NULL)
\n rb_alloc() + attach new rb
\n refcount_set(&event->mmap_count, 1)
\n lock; event->mmap_count 1 -> 0
\n ring_buffer_attach(event, NULL)
\n ring_buffer_put() -> frees the *new* rb<\/p>\n
The revival’s refcount_set(&event->mmap_count, 1) is an invisible
\n1 -> 1 write: the close frees the just-revived buffer although the
\nother process still has it mapped — a page-level use-after-free
\nallowing local privilege escalation to root by any unprivileged user
\n(default kernel.perf_event_paranoid=2).<\/p>\n
Swap the order of the two counter updates: event->mmap_count is
\ndropped first via refcount_dec_and_mutex_lock(), so its 1 -> 0
\ntransition and the ring_buffer_attach() stay serialized with
\nperf_mmap(). rb->mmap_count == 0 then implies every event using the
\nbuffer is detached already, so the result of the rb->mmap_count drop
\ncan gate the remaining teardown directly and detach_rest is no longer
\nneeded.<\/p>\n
An earlier fix for this race from Kyle Zeng and David Lee takes
\nevent->mmap_mutex around both counter updates [0]; here the not-last
\nclose stays lockless.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
perf: Fix use-after-free when perf mmap() revival races with the last munmap()<\/p>\n
perf_mmap_close() drops rb->mmap_count *without* ho<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24448","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24448","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24448"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24448"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24448"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}