CVE-2024-43870

CVE Details

Release Date:

2024-08-21

Description

In the Linux kernel, the following vulnerability has been resolved:\nperf: Fix event leak upon exit\nWhen a task is scheduled out, pending sigtrap deliveries are deferred\nto the target task upon resume to userspace via task_work.\nHowever failures while adding an event's callback to the task_work\nengine are ignored. And since the last call for events exit happen\nafter task work is eventually closed, there is a small window during\nwhich pending sigtrap can be queued though ignored, leaking the event\nrefcount addition such as in the following scenario:\nTASK A\n-----\ndo_exit()\nexit_task_work(tsk);\n\nperf_event_overflow()\nevent->pending_sigtrap = pending_id;\nirq_work_queue(&event->pending_irq);\n\n=========> PREEMPTION: TASK A -> TASK B\nevent_sched_out()\nevent->pending_sigtrap = 0;\natomic_long_inc_not_zero(&event->refcount)\n// FAILS: task work has exited\ntask_work_add(&event->pending_task)\n[...]\n\nperf_pending_irq()\n// early return: event->oncpu = -1\n\n[...]\n=========> TASK B -> TASK A\nperf_event_exit_task(tsk)\nperf_event_exit_event()\nfree_event()\nWARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1)\n// leak event due to unexpected refcount == 2\nAs a result the event is never released while the task exits.\nFix this with appropriate task_work_add()'s error handling.

See more information about CVE-2024-43870 from MITRE CVE dictionary and NIST NVD

CVSS Scoring

NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score:	5.1	CVSS Vector:	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
Attack Vector:	Local network	Attack Complexity:	Low
Privileges Required:	High	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	Low
Integrity Impact:	None	Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (kernel-uek)	ELSA-2024-12815	2024-11-11
Oracle Linux version 9 (kernel)	ELSA-2024-9315	2024-11-14
Oracle Linux version 9 (kernel-uek)	ELSA-2024-12815	2024-11-11