CVE-2024-43870 perf: Fix event leak upon exit

2024-08-2100:06:21

Linux

www.cve.org

linux kernel

fix event leak

task work

perf event

EPSS

Percentile

16.4%

JSON

In the Linux kernel, the following vulnerability has been resolved:

perf: Fix event leak upon exit

When a task is scheduled out, pending sigtrap deliveries are deferred
to the target task upon resume to userspace via task_work.

However failures while adding an event’s callback to the task_work
engine are ignored. And since the last call for events exit happen
after task work is eventually closed, there is a small window during
which pending sigtrap can be queued though ignored, leaking the event
refcount addition such as in the following scenario:

TASK A
-----

do_exit()
   exit_task_work(tsk);

   &lt;IRQ&gt;
   perf_event_overflow()
      event-&gt;pending_sigtrap = pending_id;
      irq_work_queue(&event-&gt;pending_irq);
   &lt;/IRQ&gt;
=========&gt; PREEMPTION: TASK A -&gt; TASK B
   event_sched_out()
      event-&gt;pending_sigtrap = 0;
      atomic_long_inc_not_zero(&event-&gt;refcount)
      // FAILS: task work has exited
      task_work_add(&event-&gt;pending_task)
   [...]
   &lt;IRQ WORK&gt;
   perf_pending_irq()
      // early return: event-&gt;oncpu = -1
   &lt;/IRQ WORK&gt;
   [...]
=========&gt; TASK B -&gt; TASK A
   perf_event_exit_task(tsk)
      perf_event_exit_event()
         free_event()
            WARN(atomic_long_cmpxchg(&event-&gt;refcount, 1, 0) != 1)
            // leak event due to unexpected refcount == 2

As a result the event is never released while the task exits.

Fix this with appropriate task_work_add()'s error handling.

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "kernel/events/core.c"
    ],
    "versions": [
      {
        "version": "8bffa95ac19f",
        "lessThan": "67fad724f1b5",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "517e6a301f34",
        "lessThan": "70882d7fa74f",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "517e6a301f34",
        "lessThan": "05d3fd599594",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "517e6a301f34",
        "lessThan": "3d7a63352a93",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "517e6a301f34",
        "lessThan": "2fd5ad3f310d",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "kernel/events/core.c"
    ],
    "versions": [
      {
        "version": "6.1",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "6.1",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.15.165",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.1.103",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.6.44",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.10.3",
        "lessThanOrEqual": "6.10.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.11",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]