In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tracing: Set the trace clock before registering the histogram trigger<\/p>\n
hist_register_trigger() puts the trigger on the global named_triggers
\nlist in cmd_ops->init(), and only then sets the trace clock:<\/p>\n
\tif (data->cmd_ops->init) {
\n\t\tret = data->cmd_ops->init(data);
\n\t\tif (ret enable_timestamps) {
\n\t\tret = tracing_set_clock(file->tr, hist_data->attrs->clock);
\n\t\tif (ret) {
\n\t\t\thist_err(tr, HIST_ERR_SET_CLOCK_FAIL, errpos(clock));
\n\t\t\tgoto out;
\n\t\t}<\/p>\n
The clock string is not checked anywhere before that call, so a named
\ntrigger using common_timestamp with an unknown clock fails after it has
\nalready become findable. event_hist_trigger_parse() then frees it
\nwithout taking it off the list, and the next lookup by name reads the
\nfreed object:<\/p>\n
~# cd \/sys\/kernel\/tracing\/events\/sched\/sched_switch
\n ~# echo ‘hist:name=foo:keys=common_pid:ts=common_timestamp:clock=bogus’ > trigger
\n bash: echo: write error: Invalid argument
\n ~# echo ‘hist:name=foo:keys=common_pid’ > trigger<\/p>\n
BUG: KASAN: slab-use-after-free in find_named_trigger+0xac\/0xc0
\n Read of size 8 at addr ffff88800915d760 by task init\/1
\n find_named_trigger+0xac\/0xc0
\n hist_register_trigger+0xc1\/0x900
\n event_hist_trigger_parse+0x3146\/0x6af0
\n event_trigger_write+0xce\/0x160
\n Freed by task 63:
\n kfree+0x154\/0x420
\n trigger_kthread_fn+0xfd\/0x160<\/p>\n
Set the clock before the trigger is registered, so that nothing which
\ncan fail runs after it is published, the way commit 6f86bdeab633
\n(“tracing: Fix bad hist from corrupting named_triggers list”) moved the
\nregistration below the rest of the setup.<\/p>\n
tracing_set_filter_buffering() is reference counted, so the init failure
\npath has to drop the reference that the clock block now takes first.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tracing: Set the trace clock before registering the histogram trigger<\/p>\n
hist_register_trigger() puts the trigger on the global named<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29091","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29091","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29091"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29091"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29091"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}