In the Linux kernel, the following vulnerability has been resolved:
perf: Fix event leak upon exit
When a task is scheduled out, pending sigtrap deliveries are deferred to the target task upon resume to userspace via task_work.
However failures while adding an event's callback to the task_work engine are ignored. And since the last call for events exit happen after task work is eventually closed, there is a small window during which pending sigtrap can be queued though ignored, leaking the event refcount addition such as in the following scenario:
TASK A
-----
do_exit()
exit_task_work(tsk);
<IRQ>
perf_event_overflow()
event->pending_sigtrap = pending_id;
irq_work_queue(&event->pending_irq);
</IRQ>
=========> PREEMPTION: TASK A -> TASK B
event_sched_out()
event->pending_sigtrap = 0;
atomic_long_inc_not_zero(&event->refcount)
// FAILS: task work has exited
task_work_add(&event->pending_task)
[...]
<IRQ WORK>
perf_pending_irq()
// early return: event->oncpu = -1
</IRQ WORK>
[...]
=========> TASK B -> TASK A
perf_event_exit_task(tsk)
perf_event_exit_event()
free_event()
WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1)
// leak event due to unexpected refcount == 2
As a result the event is never released while the task exits.
Fix this with appropriate taskworkadd()'s error handling.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43870.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43870.json"
[
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05d3fd599594abf79aad4484bccb2b26e1cb0b51",
"digest": {
"function_hash": "217629107946117882909663779302731697186",
"length": 1200.0
},
"id": "CVE-2024-43870-0f8c1ffe",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "event_sched_out"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2fd5ad3f310de22836cdacae919dd99d758a1f1b",
"digest": {
"function_hash": "192366547653852773832397183328338889776",
"length": 1224.0
},
"id": "CVE-2024-43870-1174be06",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "event_sched_out"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67fad724f1b568b356c1065d50df46e6b30eb2f7",
"digest": {
"function_hash": "119885556128847106199464443797571713092",
"length": 1182.0
},
"id": "CVE-2024-43870-206d5874",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "event_sched_out"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d7a63352a93bdb8a1cdf29606bf617d3ac1c22a",
"digest": {
"function_hash": "192366547653852773832397183328338889776",
"length": 1224.0
},
"id": "CVE-2024-43870-6bb98b71",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "event_sched_out"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05d3fd599594abf79aad4484bccb2b26e1cb0b51",
"digest": {
"line_hashes": [
"274687124330384976156564242832566038590",
"66995282980042520925934897656440012840",
"295207112045113905800834583271255422642",
"284204233043878311676903874636471223729",
"87854881996364971440112865248399383130",
"14988314908002215960328871762336311176",
"14026067459844898236699215095012382499",
"265052235242208139802746770892388454318",
"323264589616557309143889274991426231567",
"131188222465560974267657492628038394113",
"85308416501738353595679771222822432484",
"66815120414509440631543619955171006105",
"185735681203095284771700879466558752543",
"7008644296362927536914760061943757098"
],
"threshold": 0.9
},
"id": "CVE-2024-43870-6d4a6bbb",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2fd5ad3f310de22836cdacae919dd99d758a1f1b",
"digest": {
"line_hashes": [
"274687124330384976156564242832566038590",
"66995282980042520925934897656440012840",
"295207112045113905800834583271255422642",
"284204233043878311676903874636471223729",
"87854881996364971440112865248399383130",
"14988314908002215960328871762336311176",
"14026067459844898236699215095012382499",
"265052235242208139802746770892388454318",
"323264589616557309143889274991426231567",
"131188222465560974267657492628038394113",
"85308416501738353595679771222822432484",
"66815120414509440631543619955171006105",
"185735681203095284771700879466558752543",
"7008644296362927536914760061943757098"
],
"threshold": 0.9
},
"id": "CVE-2024-43870-99105191",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67fad724f1b568b356c1065d50df46e6b30eb2f7",
"digest": {
"line_hashes": [
"274687124330384976156564242832566038590",
"66995282980042520925934897656440012840",
"295207112045113905800834583271255422642",
"284204233043878311676903874636471223729",
"87854881996364971440112865248399383130",
"14988314908002215960328871762336311176",
"14026067459844898236699215095012382499",
"265052235242208139802746770892388454318",
"323264589616557309143889274991426231567",
"131188222465560974267657492628038394113",
"85308416501738353595679771222822432484",
"66815120414509440631543619955171006105",
"185735681203095284771700879466558752543",
"7008644296362927536914760061943757098"
],
"threshold": 0.9
},
"id": "CVE-2024-43870-9a0fe5d0",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70882d7fa74f0731492a0d493e8515a4f7131831",
"digest": {
"function_hash": "119885556128847106199464443797571713092",
"length": 1182.0
},
"id": "CVE-2024-43870-b0f8b0ad",
"deprecated": false,
"target": {
"file": "kernel/events/core.c",
"function": "event_sched_out"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d7a63352a93bdb8a1cdf29606bf617d3ac1c22a",
"digest": {
"line_hashes": [
"274687124330384976156564242832566038590",
"66995282980042520925934897656440012840",
"295207112045113905800834583271255422642",
"284204233043878311676903874636471223729",
"87854881996364971440112865248399383130",
"14988314908002215960328871762336311176",
"14026067459844898236699215095012382499",
"265052235242208139802746770892388454318",
"323264589616557309143889274991426231567",
"131188222465560974267657492628038394113",
"85308416501738353595679771222822432484",
"66815120414509440631543619955171006105",
"185735681203095284771700879466558752543",
"7008644296362927536914760061943757098"
],
"threshold": 0.9
},
"id": "CVE-2024-43870-e0879dfb",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70882d7fa74f0731492a0d493e8515a4f7131831",
"digest": {
"line_hashes": [
"274687124330384976156564242832566038590",
"66995282980042520925934897656440012840",
"295207112045113905800834583271255422642",
"284204233043878311676903874636471223729",
"87854881996364971440112865248399383130",
"14988314908002215960328871762336311176",
"14026067459844898236699215095012382499",
"265052235242208139802746770892388454318",
"323264589616557309143889274991426231567",
"131188222465560974267657492628038394113",
"85308416501738353595679771222822432484",
"66815120414509440631543619955171006105",
"185735681203095284771700879466558752543",
"7008644296362927536914760061943757098"
],
"threshold": 0.9
},
"id": "CVE-2024-43870-e9f71d5d",
"deprecated": false,
"target": {
"file": "kernel/events/core.c"
}
}
]