Summary

tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'

When generate a synthetic event with many params and then create a trace
action for it [1], kernel panic happened [2].

It is because that in trace_action_create() 'data->n_params' is up to
SYNTH_FIELDS_MAX (current value is 64), and array 'data->var_ref_idx'
keeps indices into array 'hist_data->var_refs' for each synthetic event
param, but the length of 'data->var_ref_idx' is TRACING_MAP_VARS_MAX
(current value is 16), so out-of-bound write happened when 'data->n_params'
more than 16. In this case, 'data->match_data.event' is overwritten and
eventually cause the panic.

To solve the issue, adjust the length of 'data->var_ref_idx' to be
SYNTH_FIELDS_MAX and add sanity checks to avoid out-of-bound write.

[1]

cd /sys/kernel/tracing/

echo "my_synth_event int v1; int v2; int v3; int v4; int v5; int v6;\

int v7; int v8; int v9; int v10; int v11; int v12; int v13; int v14;
int v15; int v16; int v17; int v18; int v19; int v20; int v21; int v22;
int v23; int v24; int v25; int v26; int v27; int v28; int v29; int v30;
int v31; int v32; int v33; int v34; int v35; int v36; int v37; int v38;
int v39; int v40; int v41; int v42; int v43; int v44; int v45; int v46;
int v47; int v48; int v49; int v50; int v51; int v52; int v53; int v54;
int v55; int v56; int v57; int v58; int v59; int v60; int v61; int v62;
int v63" >> synthetic_events

echo '…

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.229"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.10.163"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.6.0"},{"fixed":"5.15.87"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"6.0.18"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.4"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2022-50553 linux Fixed in: 5.10.178-1
Ubuntu UBUNTU-CVE-2022-50553 linux