CVE-2024-56665

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog

Syzbot reported [1] crash that happens for following tracing scenario:

- create tracepoint perf event with attr.inherit=1, attach it to the

process and set bpf program to it

- attached process forks -> chid creates inherited event

the new child event shares the parent's bpf program and tp_event

(hence prog_array) which is global for tracepoint

- exit both process and its child -> release both events

- first perf_event_detach_bpf_prog call will release tp_event->prog_array

and second perf_event_detach_bpf_prog will crash, because

tp_event->prog_array is NULL

The fix makes sure the perf_event_detach_bpf_prog checks prog_array

is valid before it tries to remove the bpf program from it.

[1] https://lore.kernel.org/bpf/Z1MR6dCIKajNS6nU@krava/T/#m91dbf0688221ec7a7fc95e896a7ef9ff93b0b8ad

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References