U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Vulnerability Change Records for CVE-2024-43870

Change History

New CVE Received by NIST 8/20/2024 9:15:11 PM

Action Type Old Value New Value
Added Description

								
							
							
						
In the Linux kernel, the following vulnerability has been resolved:

perf: Fix event leak upon exit

When a task is scheduled out, pending sigtrap deliveries are deferred
to the target task upon resume to userspace via task_work.

However failures while adding an event's callback to the task_work
engine are ignored. And since the last call for events exit happen
after task work is eventually closed, there is a small window during
which pending sigtrap can be queued though ignored, leaking the event
refcount addition such as in the following scenario:

    TASK A
    -----

    do_exit()
       exit_task_work(tsk);

       <IRQ>
       perf_event_overflow()
          event->pending_sigtrap = pending_id;
          irq_work_queue(&event->pending_irq);
       </IRQ>
    =========> PREEMPTION: TASK A -> TASK B
       event_sched_out()
          event->pending_sigtrap = 0;
          atomic_long_inc_not_zero(&event->refcount)
          // FAILS: task work has exited
          task_work_add(&event->pending_task)
       [...]
       <IRQ WORK>
       perf_pending_irq()
          // early return: event->oncpu = -1
       </IRQ WORK>
       [...]
    =========> TASK B -> TASK A
       perf_event_exit_task(tsk)
          perf_event_exit_event()
             free_event()
                WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1)
                // leak event due to unexpected refcount == 2

As a result the event is never released while the task exits.

Fix this with appropriate task_work_add()'s error handling.
Added Reference

								
							
							
						
kernel.org https://git.kernel.org/stable/c/05d3fd599594abf79aad4484bccb2b26e1cb0b51 [No types assigned]
Added Reference

								
							
							
						
kernel.org https://git.kernel.org/stable/c/2fd5ad3f310de22836cdacae919dd99d758a1f1b [No types assigned]
Added Reference

								
							
							
						
kernel.org https://git.kernel.org/stable/c/3d7a63352a93bdb8a1cdf29606bf617d3ac1c22a [No types assigned]
Added Reference

								
							
							
						
kernel.org https://git.kernel.org/stable/c/67fad724f1b568b356c1065d50df46e6b30eb2f7 [No types assigned]
Added Reference

								
							
							
						
kernel.org https://git.kernel.org/stable/c/70882d7fa74f0731492a0d493e8515a4f7131831 [No types assigned]