lkml.org 
[lkml]   [2022]   [May]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH 1/7] kthread: Don't allocate kthread_struct for init and umh
chill <maximkabox13@gmail.com> writes:

> this looks like a real uaf vulnerability and can be executed by the user

The potential to use memory after it has been freed appears completely
real. As such it is a bug and it should definitely be fixed. That is
as far as I can see.

What I don't see, and I am very bad at this so I could be missing
something, is what bad thing kthread_is_per_cpu could be tricked into
doing.

I see a window of a single instruction which reads a single bit
that normally will return false. If that bit instead reads true
it looks like the scheduler will simply decide to not run the
process on another cpu.


So I will put this change in linux-next. It will be tested and I will
send it to Linus when the merge window for v5.19 opens. After Linus
merges this I expect after a week or so it will be backported to the
various stable kernels. Not that it needs to go farther than about
v5.17 where I introduced the bug.

Eric

\
 
 \ /
  Last update: 2022-05-06 22:55    [W:0.181 / U:0.560 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site