From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8B0D9146A97 for ; Tue, 21 May 2024 15:40:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716306016; cv=none; b=C3uRV7OytAdZYdsnDQaWBlhhOduI9zW5LiJ9b8HSIdY3/yrnA9id6tgQ+A0PkrCfEitW1Z68bNypd+afqbXRXrUcKx3NbqHwSibR+Btb/CDzlntdCyJg4dxUfsPfNKS8iRgSfhCuwMGNNxtnTjHyyRp9S+kjTWzw64ZTIEMip5I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716306016; c=relaxed/simple; bh=Dqu2/mYtT/cikG5rQoXSPclUfx8CiUopNTRr/L+wPj0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Duc37b1D/LePa4VRCxu2fGBlReFDkc7JBRrUpukjmk1nAYfa2byoE4zZzwIcR22VgMcRjnHsKqBt5ItJJW/oWbwaXrX7npJ4KsHPy6LMk9MhpnrMwh0TCB3l+FCrN5yavfDt9PiynrQszPCYX5E99dy/KN2Ry6VrOafwaj2ou50= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=yjFaVKo+; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="yjFaVKo+" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 171F2C2BD11; Tue, 21 May 2024 15:40:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1716306016; bh=Dqu2/mYtT/cikG5rQoXSPclUfx8CiUopNTRr/L+wPj0=; h=From:To:Cc:Subject:Date:Reply-to:From; b=yjFaVKo+VSQBRQjqouOkRAk7MWhKMuFNo4rDAuAoCRxDT/389PxWW7ZkPhk0HSVjp 58eYqOqCZ1D/+lIIf+I4lVuSZwmGjANJLNVR5bz1L/hqF8st7mlZa5rsq/sO17u5/f 8lSXp8lTvsiRDaxWefFsYSFGj8o/9YAja8FsrMl0= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2023-52879: tracing: Have trace_event_file have ref counters Date: Tue, 21 May 2024 17:32:55 +0200 Message-ID: <2024052122-CVE-2023-52879-fa4d@gregkh> X-Mailer: git-send-email 2.45.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=4751; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=Dqu2/mYtT/cikG5rQoXSPclUfx8CiUopNTRr/L+wPj0=; b=owGbwMvMwCRo6H6F97bub03G02pJDGk++7wdAnbOvNEmeEP3t8GrDXwMJ5bk+C9faWQvNr9pw sKjZ+8YdMSyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEDm5kmKe26KXG27R6VX6e aVMXm1S6tNgt8WVY0DJx8spjgWvcb6UzV8xbdNfjPuMEHgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: tracing: Have trace_event_file have ref counters The following can crash the kernel: # cd /sys/kernel/tracing # echo 'p:sched schedule' > kprobe_events # exec 5>>events/kprobes/sched/enable # > kprobe_events # exec 5>&- The above commands: 1. Change directory to the tracefs directory 2. Create a kprobe event (doesn't matter what one) 3. Open bash file descriptor 5 on the enable file of the kprobe event 4. Delete the kprobe event (removes the files too) 5. Close the bash file descriptor 5 The above causes a crash! BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 877 Comm: bash Not tainted 6.5.0-rc4-test-00008-g2c6b6b1029d4-dirty #186 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:tracing_release_file_tr+0xc/0x50 What happens here is that the kprobe event creates a trace_event_file "file" descriptor that represents the file in tracefs to the event. It maintains state of the event (is it enabled for the given instance?). Opening the "enable" file gets a reference to the event "file" descriptor via the open file descriptor. When the kprobe event is deleted, the file is also deleted from the tracefs system which also frees the event "file" descriptor. But as the tracefs file is still opened by user space, it will not be totally removed until the final dput() is called on it. But this is not true with the event "file" descriptor that is already freed. If the user does a write to or simply closes the file descriptor it will reference the event "file" descriptor that was just freed, causing a use-after-free bug. To solve this, add a ref count to the event "file" descriptor as well as a new flag called "FREED". The "file" will not be freed until the last reference is released. But the FREE flag will be set when the event is removed to prevent any more modifications to that event from happening, even if there's still a reference to the event "file" descriptor. The Linux kernel CVE team has assigned CVE-2023-52879 to this issue. Affected and fixed versions =========================== Issue introduced in 5.4.258 with commit e6807c873d87 and fixed in 5.4.262 with commit 961c4511c757 Issue introduced in 5.10.198 with commit 407bf1c140f0 and fixed in 5.10.202 with commit a98172e36e5f Issue introduced in 5.15.134 with commit fa6d449e4d02 and fixed in 5.15.140 with commit cbc7c29dff0f Issue introduced in 6.1.55 with commit a46bf337a20f and fixed in 6.1.64 with commit 2fa74d29fc18 Issue introduced in 6.5.5 with commit 9beec0437013 and fixed in 6.5.13 with commit 2c9de867ca28 Issue introduced in 6.6 with commit f5ca233e2e66 and fixed in 6.6.1 with commit 9034c87d61be Issue introduced in 6.6 with commit f5ca233e2e66 and fixed in 6.7 with commit bb32500fb9b7 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-52879 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: include/linux/trace_events.h kernel/trace/trace.c kernel/trace/trace.h kernel/trace/trace_events.c kernel/trace/trace_events_filter.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/961c4511c7578d6b8f39118be919016ec3db1c1e https://git.kernel.org/stable/c/a98172e36e5f1b3d29ad71fade2d611cfcc2fe6f https://git.kernel.org/stable/c/cbc7c29dff0fa18162f2a3889d82eeefd67305e0 https://git.kernel.org/stable/c/2fa74d29fc1899c237d51bf9a6e132ea5c488976 https://git.kernel.org/stable/c/2c9de867ca285c397cd71af703763fe416265706 https://git.kernel.org/stable/c/9034c87d61be8cff989017740a91701ac8195a1d https://git.kernel.org/stable/c/bb32500fb9b78215e4ef6ee8b4345c5f5d7eafb4