In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
exec: Cleanup POSIX timers right after de_thread()<\/p>\n
A per-thread CPU timer holds a reference to the PID of the thread it is
\nattached to and, while it is armed, its node is queued in that thread’s
\nposix_cputimers. The task is looked up by that PID.<\/p>\n
When a non-leader thread exec()s, de_thread() changes which task owns
\nthat PID. pid_task(timer->it.cpu.pid, PIDTYPE_PID) then returns NULL,
\nbut the node is still queued on tsk, which is alive. timer_lock_sighand()
\ntakes a failed lookup to mean that the node is already dequeued, so it
\nhas nothing to undo.<\/p>\n
begin_new_exec() calls posix_cpu_timers_exit(me) right after
\nexec_task_namespaces() and that removes the leftover node, so the state
\nnormally stays invisible. But bprm->point_of_no_return is set before
\nde_thread(), so if unshare_files(), set_mm_exe_file(), exec_mmap() or
\nexec_task_namespaces() fails, the task dies before it gets there.
\nexit_itimers() then frees the k_itimer while its node is still queued,
\nand reaping tsk later erases that freed node from the rbtree.<\/p>\n
In short:<\/p>\n
the non-leader thread B the parent<\/p>\n
timer_create(CLOCK_THREAD_CPUTIME_ID)
\n timer_settime()
\n arm_timer() \/\/ the node is queued on B
\n execve()
\n de_thread(B)
\n exchange_tids(B, leader) \/\/ B’s PID now belongs to the leader
\n release_task(leader)
\n __exit_signal(leader)
\n posix_cpu_timers_exit(leader) \/\/ cleans leader’s queue, not B’s
\n __unhash_process(leader) \/\/ that PID has no task anymore
\n exec_mmap()
\n mmap_read_lock_killable(old_mm)
\n kill(B, SIGKILL)
\n \/\/ -EINTR
\n get_signal()
\n do_exit()
\n exit_itimers()
\n posix_timer_delete()
\n posix_cpu_timer_del()
\n posix_timer_unhash_and_free() \/\/ freed while still queued
\n wait4()
\n release_task(B)
\n posix_cpu_timers_exit(B)
\n cleanup_timerqueue()
\n timerqueue_del() \/\/ use-after-free<\/p>\n
Move the POSIX timer cleanup right after de_thread() before any of the
\nlater failure conditions brings the task into do_exit().<\/p>\n
[ tglx: Move the cleanup right after de_thread() ]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
exec: Cleanup POSIX timers right after de_thread()<\/p>\n
A per-thread CPU timer holds a reference to the PID of the thread it is
\nattache<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33329","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33329","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33329"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33329"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33329"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}