In the Linux kernel, the following vulnerability has been resolved:
perf: Fix event leak upon exit
When a task is scheduled out, pending sigtrap deliveries are deferred
to the target task upon resume to userspace via task_work.
However failures while adding an event's callback to the task_work
engine are ignored. And since the last call for events exit happen
after task work is eventually closed, there is a small window during
which pending sigtrap can be queued though ignored, leaking the event
refcount addition such as in the following scenario:
TASK A
-----
do_exit()
exit_task_work(tsk);
<IRQ>
perf_event_overflow()
event->pending_sigtrap = pending_id;
irq_work_queue(&event->pending_irq);
</IRQ>
=========> PREEMPTION: TASK A -> TASK B
event_sched_out()
event->pending_sigtrap = 0;
atomic_long_inc_not_zero(&event->refcount)
// FAILS: task work has exited
task_work_add(&event->pending_task)
[...]
<IRQ WORK>
perf_pending_irq()
// early return: event->oncpu = -1
</IRQ WORK>
[...]
=========> TASK B -> TASK A
perf_event_exit_task(tsk)
perf_event_exit_event()
free_event()
WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1)
// leak event due to unexpected refcount == 2
As a result the event is never released while the task exits.
Fix this with appropriate task_work_add()'s error handling.
References
Configurations
Configuration 1 (hide)
|
History
26 Sep 2025, 18:36
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/05d3fd599594abf79aad4484bccb2b26e1cb0b51 - Patch | |
| References | () https://git.kernel.org/stable/c/2fd5ad3f310de22836cdacae919dd99d758a1f1b - Patch | |
| References | () https://git.kernel.org/stable/c/3d7a63352a93bdb8a1cdf29606bf617d3ac1c22a - Patch | |
| References | () https://git.kernel.org/stable/c/67fad724f1b568b356c1065d50df46e6b30eb2f7 - Patch | |
| References | () https://git.kernel.org/stable/c/70882d7fa74f0731492a0d493e8515a4f7131831 - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CWE | CWE-401 | |
| CPE | cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.1:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
|
| First Time |
Linux
Linux linux Kernel |
Information
Published : 2024-08-21 01:15
Updated : 2025-09-26 18:36
NVD link : CVE-2024-43870
Mitre link : CVE-2024-43870
CVE.ORG link : CVE-2024-43870
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-401
Missing Release of Memory after Effective Lifetime