In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tracing: Fix memory corruption from the histogram stacktrace modifier<\/p>\n
parse_field() sets HIST_FIELD_FL_STACKTRACE from the “.stacktrace”
\nmodifier before it looks the field name up, and nothing afterwards
\nchecks that the name resolved to a field which holds a stacktrace.
\ncreate_hist_field() picks HIST_FIELD_FN_STACK on the strength of the
\nfield pointer alone, which reads a __data_loc word from the record and
\nfollows its low 16 bits as an offset into the same record.
\nevent_hist_trigger() takes the first word there as an entry count and
\ncopies that many longs into a 31 entry array:<\/p>\n
\tn_entries = *stack;
\n\tmemcpy(entries, ++stack, n_entries * sizeof(unsigned long));<\/p>\n
Neither end of that copy is bounded, and the count is whatever the event
\nholds at the offset, so any field will do:<\/p>\n
# cd \/sys\/kernel\/tracing\/events\/sched\/sched_process_fork
\n # echo ‘hist:keys=parent_pid.stacktrace’ > trigger
\n # (true)<\/p>\n
BUG: kernel NULL pointer dereference, address: 0000000000000008
\n RIP: 0010:rb_insert_color+0x18\/0x130
\n timerqueue_linked_add+0x7e\/0xd0
\n enqueue_hrtimer+0x39\/0xb0
\n __hrtimer_run_queues+0x10f\/0x1f0<\/p>\n
RIP: 0010:memcpy+0xc\/0x30
\n event_hist_trigger+0x165\/0x690<\/p>\n
The timer interrupt landed on the rbtree the copy had already run over.
\nNo debug options are needed for this; KASAN reports the same write as an
\nout-of-bounds read of 13835058055416381440 bytes.<\/p>\n
Documentation\/trace\/histogram.rst already states the rule, “must be a
\nlong[] type”, so enforce it once the name has been resolved. Names which
\nresolve to no field at all, “hitcount.stacktrace” and the common_*
\npseudo-fields, are refused for the same reason: they hold no stacktrace
\nto read.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tracing: Fix memory corruption from the histogram stacktrace modifier<\/p>\n
parse_field() sets HIST_FIELD_FL_STACKTRACE from the “.stack<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29092","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29092","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29092"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29092"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29092"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}