bpf,perf: Fix invalid prog_array access in perf_event_detach…(CVE-2024-56665)

概要

bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

In the Linux kernel, the following vulnerability has been resolved:

bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog

Syzbot reported [1] crash that happens for following tracing scenario:

create tracepoint perf event with attr.inherit=1, attach it to the
process and set bpf program to it
attached process forks -> chid creates inherited event

the new child event shares the parent's bpf program and tp_event
(hence prog_array) which is global for tracepoint
exit both process and its child -> release both events
first perf_event_detach_bpf_prog call will release tp_event->prog_array
and second perf_event_detach_bpf_prog will crash, because
tp_event->prog_array is NULL

The fix makes sure the perf_event_detach_bpf_prog checks prog_array
is valid before it tries to remove the bpf program from it.

[1] https://lore.kernel.org/bpf/Z1MR6dCIKajNS6nU@krava/T/#m91dbf0688221ec7a7fc95e896a7ef9ff93b0b8ad

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.121"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.67"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.6"}]}]

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

BellSoft Alpaquita BELL-CVE-2024-56665 linux-lts 修正版: 6.1.121-r0
Debian DEBIAN-CVE-2024-56665 linux 修正版: 6.1.123-1
Ubuntu UBUNTU-CVE-2024-56665 linux-hwe-edge

概要

原文の説明

影響パッケージ

ディストリビューション別の修正状況

参照URL