We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-39486

drm/drm_file: Fix pid refcounting race



Description

In the Linux kernel, the following vulnerability has been resolved: drm/drm_file: Fix pid refcounting race <maarten.lankhorst@linux.intel.com>, Maxime Ripard <mripard@kernel.org>, Thomas Zimmermann <tzimmermann@suse.de> filp->pid is supposed to be a refcounted pointer; however, before this patch, drm_file_update_pid() only increments the refcount of a struct pid after storing a pointer to it in filp->pid and dropping the dev->filelist_mutex, making the following race possible: process A process B ========= ========= begin drm_file_update_pid mutex_lock(&dev->filelist_mutex) rcu_replace_pointer(filp->pid, <pid B>, 1) mutex_unlock(&dev->filelist_mutex) begin drm_file_update_pid mutex_lock(&dev->filelist_mutex) rcu_replace_pointer(filp->pid, <pid A>, 1) mutex_unlock(&dev->filelist_mutex) get_pid(<pid A>) synchronize_rcu() put_pid(<pid B>) *** pid B reaches refcount 0 and is freed here *** get_pid(<pid B>) *** UAF *** synchronize_rcu() put_pid(<pid A>) As far as I know, this race can only occur with CONFIG_PREEMPT_RCU=y because it requires RCU to detect a quiescent state in code that is not explicitly calling into the scheduler. This race leads to use-after-free of a "struct pid". It is probably somewhat hard to hit because process A has to pass through a synchronize_rcu() operation while process B is between mutex_unlock() and get_pid(). Fix it by ensuring that by the time a pointer to the current task's pid is stored in the file, an extra reference to the pid has been taken. This fix also removes the condition for synchronize_rcu(); I think that optimization is unnecessary complexity, since in that case we would usually have bailed out on the lockless check above.

Reserved 2024-06-25 | Published 2024-07-06 | Updated 2024-12-19 | Assigner Linux

Product status

Default status
unaffected

031ddd28008971cce0b5626379b910d0a05fb4dd before 16682588ead4a593cf1aebb33b36df4d1e9e4ffa
affected

1c7a387ffef894b1ab3942f0482dac7a6e0a909c before 0acce2a5c619ef1abdee783d7fea5eac78ce4844
affected

1c7a387ffef894b1ab3942f0482dac7a6e0a909c before 4f2a129b33a2054e62273edd5a051c34c08d96e9
affected

Default status
affected

6.7
affected

Any version before 6.7
unaffected

6.6.37
unaffected

6.9.8
unaffected

6.10
unaffected

References

git.kernel.org/...c/16682588ead4a593cf1aebb33b36df4d1e9e4ffa

git.kernel.org/...c/0acce2a5c619ef1abdee783d7fea5eac78ce4844

git.kernel.org/...c/4f2a129b33a2054e62273edd5a051c34c08d96e9

cve.org (CVE-2024-39486)

nvd.nist.gov (CVE-2024-39486)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2024-39486

Support options

Helpdesk Chat, Email, Knowledgebase