CVE-2024-43870

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-43870
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-43870.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-43870
Downstream
Related
Published
2024-08-21T01:15:11Z
Modified
2025-09-26T18:36:28Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

perf: Fix event leak upon exit

When a task is scheduled out, pending sigtrap deliveries are deferred to the target task upon resume to userspace via task_work.

However failures while adding an event's callback to the task_work engine are ignored. And since the last call for events exit happen after task work is eventually closed, there is a small window during which pending sigtrap can be queued though ignored, leaking the event refcount addition such as in the following scenario:

TASK A
-----

do_exit()
   exit_task_work(tsk);

   <IRQ>
   perf_event_overflow()
      event->pending_sigtrap = pending_id;
      irq_work_queue(&event->pending_irq);
   </IRQ>
=========> PREEMPTION: TASK A -> TASK B
   event_sched_out()
      event->pending_sigtrap = 0;
      atomic_long_inc_not_zero(&event->refcount)
      // FAILS: task work has exited
      task_work_add(&event->pending_task)
   [...]
   &lt;IRQ WORK>
   perf_pending_irq()
      // early return: event->oncpu = -1
   &lt;/IRQ WORK>
   [...]
=========> TASK B -> TASK A
   perf_event_exit_task(tsk)
      perf_event_exit_event()
         free_event()
            WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1)
            // leak event due to unexpected refcount == 2

As a result the event is never released while the task exits.

Fix this with appropriate taskworkadd()'s error handling.

References

Affected packages