In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tracing\/user_events: Fix use-after-free in user_event_mm_dup()<\/p>\n
user_event_mm_dup() walks the parent mm’s enabler list locklessly under
\nrcu_read_lock() during fork() (from copy_process()); it does not take
\nevent_mutex:<\/p>\n
\trcu_read_lock();
\n\tlist_for_each_entry_rcu(enabler, &old_mm->enablers, mm_enablers_link)
\n\t\tenabler->event = user_event_get(orig->event);<\/p>\n
user_event_enabler_destroy() removes an enabler from that list with
\nlist_del_rcu() and then, without waiting for a grace period, drops the
\nenabler’s user_event reference with user_event_put() and frees the enabler
\nwith kfree(). A reader that loaded the enabler before the list_del_rcu()
\ncan still be walking it, which leads to two use-after-frees:<\/p>\n
– kfree(enabler) frees the enabler while that reader dereferences
\n enabler->event.<\/p>\n
– user_event_put() may drop the last reference to the user_event, which
\n is then freed (via delayed_destroy_user_event() on a work queue), while
\n the same reader does user_event_get(orig->event) on it.<\/p>\n
Both are reachable by an unprivileged task that can open user_events_data:
\none multithreaded process that registers an enabler and then concurrently
\nunregisters it and calls fork() triggers the race. KASAN reports a
\nslab-use-after-free in user_event_mm_dup() during clone(), with a
\n“refcount_t: addition on 0” warning when the user_event is freed.<\/p>\n
The enabler use-after-free was found first; the user_event one was reported
\nby XIAO WU, and the earlier enabler-only fix did not address it.<\/p>\n
Defer both the user_event_put() and the kfree(enabler) to a work item
\nqueued with queue_rcu_work(), so they run only after an RCU grace period,
\nonce all readers walking the enabler list have finished. The put must run
\nin process context because user_event_put() takes event_mutex on the last
\nreference, so a work queue is used rather than call_rcu(). The now-unlocked
\nput lets the locked argument of user_event_enabler_destroy() be removed;
\nall callers are updated.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tracing\/user_events: Fix use-after-free in user_event_mm_dup()<\/p>\n
user_event_mm_dup() walks the parent mm’s enabler list locklessly u<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6759","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6759","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6759"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6759"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6759"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}