perf: Fix event leak upon exit (CVE-2024-43870)

Résumé

perf: Fix event leak upon exit

Description d'origine

La description telle que publiée par la source (souvent en anglais).

In the Linux kernel, the following vulnerability has been resolved:

perf: Fix event leak upon exit

When a task is scheduled out, pending sigtrap deliveries are deferred
to the target task upon resume to userspace via task_work.

However failures while adding an event's callback to the task_work
engine are ignored. And since the last call for events exit happen
after task work is eventually closed, there is a small window during
which pending sigtrap can be queued though ignored, leaking the event
refcount addition such as in the following scenario:

TASK A
-----

do_exit()
   exit_task_work(tsk);

   
   perf_event_overflow()
      event->pending_sigtrap = pending_id;
      irq_work_queue(&event->pending_irq);
   
=========> PREEMPTION: TASK A -> TASK B
   event_sched_out()
      event->pending_sigtrap = 0;
      atomic_long_inc_not_zero(&event->refcount)
      // FAILS: task work has exited
      task_work_add(&event->pending_task)
   [...]
   
   perf_pending_irq()
      // early return: event->oncpu = -1
   
   [...]
=========> TASK B -> TASK A
   perf_event_exit_task(tsk)
      perf_event_exit_event()
         free_event()
            WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1)
            // leak event due to unexpected refcount == 2

As a result the event is never released while the task exits.

Fix this with appropriate task_work_add()'s error handli…

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.165"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.103"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.6.44"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.10.3"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2024-43870 linux Corrigé dans: 6.1.106-1
Ubuntu UBUNTU-CVE-2024-43870 linux-hwe-edge

Résumé

Description d'origine

Paquets affectés

État des correctifs par distribution

Références