Messages in this thread | | | From | "Eric W. Biederman" <> | Date | Fri, 06 May 2022 15:53:01 -0500 | Subject | Re: [PATCH 1/7] kthread: Don't allocate kthread_struct for init and umh |
| |
chill <maximkabox13@gmail.com> writes:
> this looks like a real uaf vulnerability and can be executed by the user
The potential to use memory after it has been freed appears completely real. As such it is a bug and it should definitely be fixed. That is as far as I can see.
What I don't see, and I am very bad at this so I could be missing something, is what bad thing kthread_is_per_cpu could be tricked into doing.
I see a window of a single instruction which reads a single bit that normally will return false. If that bit instead reads true it looks like the scheduler will simply decide to not run the process on another cpu.
So I will put this change in linux-next. It will be tested and I will send it to Linus when the merge window for v5.19 opens. After Linus merges this I expect after a week or so it will be backported to the various stable kernels. Not that it needs to go farther than about v5.17 where I introduced the bug.
Eric
| |