In the Linux kernel, the following vulnerability has been resolved:
perf: Fix event leak upon exec and file release
The perf pending task work is never waited upon the matching event release. In the case of a child event, released via free_event() directly, this can potentially result in a leaked event, such as in the following scenario that doesn't even require a weak IRQ work implementation to trigger:
schedule() preparetaskswitch() =======> <NMI> perfeventoverflow() event->pendingsigtrap = ... irqworkqueue(&event->pendingirq) <======= </NMI> perfeventtaskschedout() eventschedout() event->pendingsigtrap = 0; atomiclongincnotzero(&event->refcount) taskworkadd(&event->pendingtask) finishlockswitch() =======> <IRQ> perfpendingirq() //do nothing, rely on pending task work <======= </IRQ>
beginnewexec() perfeventexittask() perfeventexitevent() // If is child event freeevent() WARN(atomiclong_cmpxchg(&event->refcount, 1, 0) != 1) // event is leaked
Similar scenarios can also happen with perfeventremoveonexec() or simply against concurrent perfeventrelease().
Fix this with synchonizing against the possibly remaining pending task work while freeing the event, just like is done with remaining pending IRQ work. This means that the pending task callback neither need nor should hold a reference to the event, preventing it from ever beeing freed.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43869.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-43869.json"
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed2c202dac55423a52d7e2290f2888bf08b8ee99",
"digest": {
"line_hashes": [
"219217295075332094441437552955305843785",
"17582039735814974532780999940672034968",
"244336011872485279137121591385222926915",
"14227887307979766446531335197408864261",
"78007803001546948401785996361918935723",
"104204213372261094909275930315175250085",
"272017894731491110964871439593754800238",
"92387074824609730323172099892449457187",
"7170642839140994871490994882346482797",
"333828807028536897570903283882343523950",
"143369502339281156105013174493716457877",
"23686662442220566586879873947754118251",
"136216654147301984811804426827364996389",
"247194347556941229459842207149457249308",
"134303865846616475158837052985470675075",
"276162105971268240819774349853756242973",
"140032295110916969638554205116594310395",
"43626570636594227478606438118036388755",
"319815031456105882241300553760718925481",
"230742606797875189354920727014468943185",
"338851727639444871895067146761249313215",
"324409678878189089011872211178775072637",
"94362958142782912197120720674646325549",
"138750789964235229178430446052757289868",
"63671132985225593206670267849444584167",
"328731107395674306934641729892206872804",
"235961847512574414037190512013298952809",
"332220539752148717717947475711739862141"
],
"threshold": 0.9
},
"id": "CVE-2024-43869-0ba5d70c",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a5465418f5fd970e86a86c7f4075be262682840",
"digest": {
"length": 822.0,
"function_hash": "190030229414061321925727093073888500323"
},
"id": "CVE-2024-43869-1582a0d5",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "_free_event"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed2c202dac55423a52d7e2290f2888bf08b8ee99",
"digest": {
"length": 766.0,
"function_hash": "57724992108979741482742880977155839684"
},
"id": "CVE-2024-43869-2bd9d289",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "_free_event"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed2c202dac55423a52d7e2290f2888bf08b8ee99",
"digest": {
"length": 4474.0,
"function_hash": "336120852903860126879150579724714482168"
},
"id": "CVE-2024-43869-2c0ef482",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "perf_event_alloc"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a5465418f5fd970e86a86c7f4075be262682840",
"digest": {
"line_hashes": [
"219217295075332094441437552955305843785",
"17582039735814974532780999940672034968",
"244336011872485279137121591385222926915",
"14227887307979766446531335197408864261",
"78007803001546948401785996361918935723",
"104204213372261094909275930315175250085",
"272017894731491110964871439593754800238",
"92387074824609730323172099892449457187",
"7170642839140994871490994882346482797",
"333828807028536897570903283882343523950",
"143369502339281156105013174493716457877",
"23686662442220566586879873947754118251",
"136216654147301984811804426827364996389",
"247194347556941229459842207149457249308",
"134303865846616475158837052985470675075",
"276162105971268240819774349853756242973",
"140032295110916969638554205116594310395",
"43626570636594227478606438118036388755",
"319815031456105882241300553760718925481",
"230742606797875189354920727014468943185",
"338851727639444871895067146761249313215",
"324409678878189089011872211178775072637",
"94362958142782912197120720674646325549",
"138750789964235229178430446052757289868",
"63671132985225593206670267849444584167",
"328731107395674306934641729892206872804",
"235961847512574414037190512013298952809",
"332220539752148717717947475711739862141"
],
"threshold": 0.9
},
"id": "CVE-2024-43869-499140c9",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@104e258a004037bc7dba9f6085c71dad6af57ad4",
"digest": {
"line_hashes": [
"219217295075332094441437552955305843785",
"17582039735814974532780999940672034968",
"244336011872485279137121591385222926915",
"14227887307979766446531335197408864261",
"78007803001546948401785996361918935723",
"104204213372261094909275930315175250085",
"272017894731491110964871439593754800238",
"92387074824609730323172099892449457187",
"7170642839140994871490994882346482797",
"333828807028536897570903283882343523950",
"143369502339281156105013174493716457877",
"23686662442220566586879873947754118251",
"136216654147301984811804426827364996389",
"247194347556941229459842207149457249308",
"134303865846616475158837052985470675075",
"276162105971268240819774349853756242973",
"140032295110916969638554205116594310395",
"43626570636594227478606438118036388755",
"319815031456105882241300553760718925481",
"230742606797875189354920727014468943185",
"338851727639444871895067146761249313215",
"324409678878189089011872211178775072637",
"94362958142782912197120720674646325549",
"138750789964235229178430446052757289868",
"63671132985225593206670267849444584167",
"328731107395674306934641729892206872804",
"235961847512574414037190512013298952809",
"332220539752148717717947475711739862141"
],
"threshold": 0.9
},
"id": "CVE-2024-43869-4c7fa58a",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@104e258a004037bc7dba9f6085c71dad6af57ad4",
"digest": {
"length": 376.0,
"function_hash": "29674749962012666696291718381867736129"
},
"id": "CVE-2024-43869-552d7478",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "perf_pending_task"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@104e258a004037bc7dba9f6085c71dad6af57ad4",
"digest": {
"length": 822.0,
"function_hash": "190030229414061321925727093073888500323"
},
"id": "CVE-2024-43869-5a5f6bab",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "_free_event"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ad46f1fef421d43cdab3a7d1744b2f43b54dae0",
"digest": {
"length": 4504.0,
"function_hash": "311752277063525600472339386996454408977"
},
"id": "CVE-2024-43869-5dd8b637",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "perf_event_alloc"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ad46f1fef421d43cdab3a7d1744b2f43b54dae0",
"digest": {
"line_hashes": [
"231706339909932734125674380733392039126",
"185535652289854613418658992869872448217",
"225029227478511661844418838689751281879",
"160018595274623985096284631591178483802"
],
"threshold": 0.9
},
"id": "CVE-2024-43869-5f29c196",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "include/linux/perf_event.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a5465418f5fd970e86a86c7f4075be262682840",
"digest": {
"length": 1192.0,
"function_hash": "4513814627073780374845999635914476491"
},
"id": "CVE-2024-43869-63eaa1eb",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "event_sched_out"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f34d8307a73a18de5320fcc6f40403146d061891",
"digest": {
"length": 376.0,
"function_hash": "29674749962012666696291718381867736129"
},
"id": "CVE-2024-43869-6b02c3ec",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "perf_pending_task"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ad46f1fef421d43cdab3a7d1744b2f43b54dae0",
"digest": {
"length": 376.0,
"function_hash": "29674749962012666696291718381867736129"
},
"id": "CVE-2024-43869-73e21310",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "perf_pending_task"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@104e258a004037bc7dba9f6085c71dad6af57ad4",
"digest": {
"line_hashes": [
"231706339909932734125674380733392039126",
"185535652289854613418658992869872448217",
"225029227478511661844418838689751281879",
"160018595274623985096284631591178483802"
],
"threshold": 0.9
},
"id": "CVE-2024-43869-7a42c99f",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "include/linux/perf_event.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed2c202dac55423a52d7e2290f2888bf08b8ee99",
"digest": {
"line_hashes": [
"231706339909932734125674380733392039126",
"185535652289854613418658992869872448217",
"225029227478511661844418838689751281879",
"160018595274623985096284631591178483802"
],
"threshold": 0.9
},
"id": "CVE-2024-43869-8c742c29",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "include/linux/perf_event.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a5465418f5fd970e86a86c7f4075be262682840",
"digest": {
"line_hashes": [
"231706339909932734125674380733392039126",
"185535652289854613418658992869872448217",
"225029227478511661844418838689751281879",
"160018595274623985096284631591178483802"
],
"threshold": 0.9
},
"id": "CVE-2024-43869-901daf9a",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "include/linux/perf_event.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f34d8307a73a18de5320fcc6f40403146d061891",
"digest": {
"length": 822.0,
"function_hash": "190030229414061321925727093073888500323"
},
"id": "CVE-2024-43869-972e056e",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "_free_event"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f34d8307a73a18de5320fcc6f40403146d061891",
"digest": {
"line_hashes": [
"219217295075332094441437552955305843785",
"17582039735814974532780999940672034968",
"244336011872485279137121591385222926915",
"14227887307979766446531335197408864261",
"78007803001546948401785996361918935723",
"104204213372261094909275930315175250085",
"272017894731491110964871439593754800238",
"92387074824609730323172099892449457187",
"7170642839140994871490994882346482797",
"333828807028536897570903283882343523950",
"143369502339281156105013174493716457877",
"23686662442220566586879873947754118251",
"136216654147301984811804426827364996389",
"247194347556941229459842207149457249308",
"134303865846616475158837052985470675075",
"276162105971268240819774349853756242973",
"140032295110916969638554205116594310395",
"43626570636594227478606438118036388755",
"319815031456105882241300553760718925481",
"230742606797875189354920727014468943185",
"338851727639444871895067146761249313215",
"324409678878189089011872211178775072637",
"94362958142782912197120720674646325549",
"138750789964235229178430446052757289868",
"63671132985225593206670267849444584167",
"328731107395674306934641729892206872804",
"235961847512574414037190512013298952809",
"332220539752148717717947475711739862141"
],
"threshold": 0.9
},
"id": "CVE-2024-43869-9a628d33",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ad46f1fef421d43cdab3a7d1744b2f43b54dae0",
"digest": {
"line_hashes": [
"219217295075332094441437552955305843785",
"17582039735814974532780999940672034968",
"244336011872485279137121591385222926915",
"14227887307979766446531335197408864261",
"78007803001546948401785996361918935723",
"104204213372261094909275930315175250085",
"272017894731491110964871439593754800238",
"92387074824609730323172099892449457187",
"7170642839140994871490994882346482797",
"333828807028536897570903283882343523950",
"143369502339281156105013174493716457877",
"23686662442220566586879873947754118251",
"136216654147301984811804426827364996389",
"247194347556941229459842207149457249308",
"134303865846616475158837052985470675075",
"276162105971268240819774349853756242973",
"140032295110916969638554205116594310395",
"43626570636594227478606438118036388755",
"319815031456105882241300553760718925481",
"230742606797875189354920727014468943185",
"338851727639444871895067146761249313215",
"324409678878189089011872211178775072637",
"31219834948610906217292188940509223609",
"338549954328396309460927829771235312525",
"63671132985225593206670267849444584167",
"328731107395674306934641729892206872804",
"235961847512574414037190512013298952809",
"332220539752148717717947475711739862141"
],
"threshold": 0.9
},
"id": "CVE-2024-43869-9d759fd1",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@104e258a004037bc7dba9f6085c71dad6af57ad4",
"digest": {
"length": 1168.0,
"function_hash": "197991782863399514247593597431006210852"
},
"id": "CVE-2024-43869-9f48343d",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "event_sched_out"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f34d8307a73a18de5320fcc6f40403146d061891",
"digest": {
"length": 4406.0,
"function_hash": "310412548648451773508658924290124975220"
},
"id": "CVE-2024-43869-a132cd09",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "perf_event_alloc"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a5465418f5fd970e86a86c7f4075be262682840",
"digest": {
"length": 4406.0,
"function_hash": "310412548648451773508658924290124975220"
},
"id": "CVE-2024-43869-aa89c76f",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "perf_event_alloc"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ad46f1fef421d43cdab3a7d1744b2f43b54dae0",
"digest": {
"length": 1150.0,
"function_hash": "269062018050672204804079760862855408085"
},
"id": "CVE-2024-43869-b25f4146",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "event_sched_out"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed2c202dac55423a52d7e2290f2888bf08b8ee99",
"digest": {
"length": 1150.0,
"function_hash": "269062018050672204804079760862855408085"
},
"id": "CVE-2024-43869-b3a896e3",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "event_sched_out"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a5465418f5fd970e86a86c7f4075be262682840",
"digest": {
"length": 376.0,
"function_hash": "29674749962012666696291718381867736129"
},
"id": "CVE-2024-43869-b3b37380",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "perf_pending_task"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f34d8307a73a18de5320fcc6f40403146d061891",
"digest": {
"line_hashes": [
"231706339909932734125674380733392039126",
"185535652289854613418658992869872448217",
"225029227478511661844418838689751281879",
"160018595274623985096284631591178483802"
],
"threshold": 0.9
},
"id": "CVE-2024-43869-b6d5eecd",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "include/linux/perf_event.h"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9ad46f1fef421d43cdab3a7d1744b2f43b54dae0",
"digest": {
"length": 766.0,
"function_hash": "57724992108979741482742880977155839684"
},
"id": "CVE-2024-43869-ca2dd64a",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "_free_event"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed2c202dac55423a52d7e2290f2888bf08b8ee99",
"digest": {
"length": 376.0,
"function_hash": "29674749962012666696291718381867736129"
},
"id": "CVE-2024-43869-dc1de35f",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "perf_pending_task"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@104e258a004037bc7dba9f6085c71dad6af57ad4",
"digest": {
"length": 4487.0,
"function_hash": "299941480251261321702350083775886986832"
},
"id": "CVE-2024-43869-ea453d33",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "perf_event_alloc"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f34d8307a73a18de5320fcc6f40403146d061891",
"digest": {
"length": 1192.0,
"function_hash": "4513814627073780374845999635914476491"
},
"id": "CVE-2024-43869-fa6c5ac7",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c",
"function": "event_sched_out"
}
}
]