perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race Make sure that __perf_event_overflow() runs with IRQs disabled for all possible callchains. Specifically the software events can end up running it with only preemption disabled. This opens up a race vs perf_event_exit_event() and friends that will go and free various things the overflow path expects to be present, like the BPF program.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From 592903cdcbf606a838056bae6d03fc557806c914 · fixed in 4df1a45819e50993cb351682a6ae8e7ed2d233a0; From 592903cdcbf606a838056bae6d03fc557806c914 · fixed in 4f8d5812337871227bb2c98669a87c306a2f86ef; From 592903cdcbf606a838056bae6d03fc557806c914 · fixed in 5c48fdc4b4623533d86e279f51531a7ba212eb87; From 592903cdcbf606a838056bae6d03fc557806c914 · fixed in 3f89b61dd504c5b6711de9759e053b082f9abf12; From 592903cdcbf606a838056bae6d03fc557806c914 · fixed in bb190628fe5f2a73ba762a9972ba16c5e895f73e; From 592903cdcbf606a838056bae6d03fc557806c914 · fixed in c9bc1753b3cc41d0e01fbca7f035258b5f4db0ae
- Linux Linux
2.6.31
- KernelLinux
From 2.6.31 · fixed in 6.1.167; From 6.2.0 · fixed in 6.6.130; From 6.7.0 · fixed in 6.12.77; From 6.13.0 · fixed in 6.18.17; From 6.19.0 · fixed in 6.19.7