In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tracing: Take the reference before publishing the named histogram trigger<\/p>\n
event_hist_trigger_named_init() puts the trigger on the global
\nnamed_triggers list and only then takes the reference on the trigger it
\nshares its histogram with:<\/p>\n
\tdata->ref++;<\/p>\n
\tsave_named_trigger(data->named_data->name, data);<\/p>\n
\tret = event_hist_trigger_init(data->named_data);
\n\tif (ret cmd_ops);
\n\t\tdata->cmd_ops = &trigger_hist_cmd;
\n\t}<\/p>\n
\treturn ret;<\/p>\n
event_hist_trigger_init() fails when alloc_hist_pad() cannot allocate, and
\nnothing takes the trigger back off the list on the way out.
\nevent_hist_trigger_parse() frees it, and the next lookup by name reads the
\nfreed object:<\/p>\n
BUG: KASAN: slab-use-after-free in find_named_trigger+0xac\/0xc0
\n Read of size 8 at addr ffff888009346860 by task init\/1
\n find_named_trigger+0xac\/0xc0
\n hist_register_trigger+0xc1\/0xa00
\n event_hist_trigger_parse+0x3146\/0x6af0
\n event_trigger_write+0xce\/0x160
\n Freed by task 67:
\n kfree+0x154\/0x420
\n trigger_kthread_fn+0xfd\/0x160<\/p>\n
Do the reference first and publish once it has succeeded, so that nothing
\nwhich can fail runs after the trigger becomes findable.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tracing: Take the reference before publishing the named histogram trigger<\/p>\n
event_hist_trigger_named_init() puts the trigger on the <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29075","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29075","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29075"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29075"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29075"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}