CVE-2024-43870

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

perf: Fix event leak upon exit

When a task is scheduled out, pending sigtrap deliveries are deferred

to the target task upon resume to userspace via task_work.

However failures while adding an event's callback to the task_work

engine are ignored. And since the last call for events exit happen

after task work is eventually closed, there is a small window during

which pending sigtrap can be queued though ignored, leaking the event

refcount addition such as in the following scenario:

TASK A

-----

do_exit()

exit_task_work(tsk);

<IRQ>

perf_event_overflow()

event->pending_sigtrap = pending_id;

irq_work_queue(&event->pending_irq);

</IRQ>

=========> PREEMPTION: TASK A -> TASK B

event_sched_out()

event->pending_sigtrap = 0;

atomic_long_inc_not_zero(&event->refcount)

// FAILS: task work has exited

task_work_add(&e

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References