In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix use-after-free on mm_struct in bpf_find_vma()<\/p>\n
bpf_find_vma() reads task->mm and calls mmap_read_trylock(mm) without
\nholding a reference on the mm. On a foreign task, a concurrent exit_mm()
\ncan free the mm_struct between the lockless read and the trylock,
\nresulting in a use-after-free. mm_struct is not SLAB_TYPESAFE_BY_RCU.<\/p>\n
For the current task, task->mm is stable. For a foreign task, pin the mm
\nunder task->alloc_lock and release it with mmput_async(), mirroring commit
\nd8e27d2d22b6 (“bpf: fix mm lifecycle in open-coded task_vma iterator”).
\nUse spin_trylock() instead of get_task_mm() so BPF context does not block
\non alloc_lock. Reject irqs-disabled contexts and !CONFIG_MMU on the
\nforeign-task path because dropping the mm reference is not safe there.<\/p>\n
Race:<\/p>\n
CPU0 (BPF program) CPU1 (exiting task)
\n ============================ ==========================
\n bpf_find_vma(foreign_task):
\n mm = task->mm
\n exit_mm():
\n task->mm = NULL
\n mmput(mm) -> frees mm_struct
\n mmap_read_trylock(mm)
\n \/\/ UAF on mm<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix use-after-free on mm_struct in bpf_find_vma()<\/p>\n
bpf_find_vma() reads task->mm and calls mmap_read_trylock(mm) without
\nholdi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25994","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25994","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25994"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25994"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25994"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}