Heimdall Security Logo

CVE-2024-43870

Vulnérabilité non évaluée dans Linux (Linux)

CVSS 0.0 · Non évaluée
EPSS 0.2%
Linux•Linux•Versions : 6.10.3, <=6.1.*, 78e1317a174edbfd1182599bf76c092a2877672c, 6.1.103, 5.15.165, 0, 5.15.84, 8bffa95ac19ff27c8261904f89d36c7fcf215d59, 517e6a301f34613bff24a8e35b5455884f2d83d8, <=6.6.*, <70882d7fa74f0731492a0d493e8515a4f7131831, <=6.10.*, 6.0.14, 6.1, <05d3fd599594abf79aad4484bccb2b26e1cb0b51, 6.11, <=*, <=5.15.*, <2fd5ad3f310de22836cdacae919dd99d758a1f1b, 6.6.44, <5.15.165, <67fad724f1b568b356c1065d50df46e6b30eb2f7, <3d7a63352a93bdb8a1cdf29606bf617d3ac1c22a, <6.1

Description

In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exit When a task is scheduled out, pending sigtrap deliveries are deferred to the target task upon resume to userspace via task_work. However failures while adding an event's callback to the task_work engine are ignored. And since the last call for events exit happen after task work is eventually closed, there is a small window during which pending sigtrap can be queued though ignored, leaking the event refcount addition such as in the following scenario: TASK A ----- do_exit() exit_task_work(tsk); <IRQ> perf_event_overflow() event->pending_sigtrap = pending_id; irq_work_queue(&event->pending_irq); </IRQ> =========> PREEMPTION: TASK A -> TASK B event_sched_out() event->pending_sigtrap = 0; atomic_long_inc_not_zero(&event->refcount) // FAILS: task work has exited task_work_add(&event->pending_task) [...] <IRQ WORK> perf_pending_irq() // early return: event->oncpu = -1 </IRQ WORK> [...] =========> TASK B -> TASK A perf_event_exit_task(tsk) perf_event_exit_event() free_event() WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1) // leak event due to unexpected refcount == 2 As a result the event is never released while the task exits. Fix this with appropriate task_work_add()'s error handling.

Gravité et risque d'exploitation

CVE-2024-43870 obtient un score CVSS de 0.0/10, soit une gravité non évaluée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.21 %, ce qui la place devant 10.9 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions 6.10.3, <=6.1.*, 78e1317a174edbfd1182599bf76c092a2877672c, 6.1.103, 5.15.165, 0, 5.15.84, 8bffa95ac19ff27c8261904f89d36c7fcf215d59, 517e6a301f34613bff24a8e35b5455884f2d83d8, <=6.6.*, <70882d7fa74f0731492a0d493e8515a4f7131831, <=6.10.*, 6.0.14, 6.1, <05d3fd599594abf79aad4484bccb2b26e1cb0b51, 6.11, <=*, <=5.15.*, <2fd5ad3f310de22836cdacae919dd99d758a1f1b, 6.6.44, <5.15.165, <67fad724f1b568b356c1065d50df46e6b30eb2f7, <3d7a63352a93bdb8a1cdf29606bf617d3ac1c22a, <6.1) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE