CVE-2024-43853

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

cgroup/cpuset: Prevent UAF in proc_cpuset_show()

An UAF can happen when /proc/cpuset is read as reported in [1].

This can be reproduced by the following methods:

1.add an mdelay(1000) before acquiring the cgroup_lock In the

cgroup_path_ns function.

2.$cat /proc/<pid>/cpuset repeatly.

3.$mount -t cgroup -o cpuset cpuset /sys/fs/cgroup/cpuset/

$umount /sys/fs/cgroup/cpuset/ repeatly.

The race that cause this bug can be shown as below:

(umount) | (cat /proc/<pid>/cpuset)

css_release | proc_cpuset_show

css_release_work_fn | css = task_get_css(tsk, cpuset_cgrp_id);

css_free_rwork_fn | cgroup_path_ns(css->cgroup, ...);

cgroup_destroy_root | mutex_lock(&cgroup_mutex);

rebind_subsystems |

cgroup_free_root |

| // cgrp was freed, UAF

| cgroup_path_ns_locked(cgrp,..);

When the cpuset is initialized, the root node top_cpuset.css.cgrp

will point to &cgrp_dfl_root.cgrp. In cgroup v1, the mount operation will

allo

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References