CVE-2024-43870

In the Linux kernel, the following vulnerability has been resolved:

perf: Fix event leak upon exit

When a task is scheduled out, pending sigtrap deliveries are deferred to the target task upon resume to userspace via task_work.

However failures while adding an events callback to the task_work engine are ignored. And since the last call for events exit happen after task work is eventually closed, there is a small window during which pending sigtrap can be queued though ignored, leaking the event refcount addition such as in the following scenario:

TASK A
-----

do_exit()
   exit_task_work(tsk);

   <IRQ>
   perf_event_overflow()
      event->pending_sigtrap = pending_id;
      irq_work_queue(&event->pending_irq);
   </IRQ>
=========> PREEMPTION: TASK A -> TASK B
   event_sched_out()
      event->pending_sigtrap = 0;
      atomic_long_inc_not_zero(&event->refcount)
      // FAILS: task work has exited
      task_work_add(&event->pending_task)
   [...]
   <IRQ WORK>
   perf_pending_irq()
      // early return: event->oncpu = -1
   </IRQ WORK>
   [...]
=========> TASK B -> TASK A
   perf_event_exit_task(tsk)
      perf_event_exit_event()
         free_event()
            WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1)
            // leak event due to unexpected refcount == 2

As a result the event is never released while the task exits.

Fix this with appropriate task_work_add()s error handling.

Weakness

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected Software

Potential Mitigations

• Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone.
• For example, glibc in Linux provides protection against free of invalid pointers.
• When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391].
• To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.

References

• https://git.kernel.org/stable/c/05d3fd599594abf79aad4484bccb2b26e1cb0b51
• https://git.kernel.org/stable/c/2fd5ad3f310de22836cdacae919dd99d758a1f1b
• https://git.kernel.org/stable/c/3d7a63352a93bdb8a1cdf29606bf617d3ac1c22a
• https://git.kernel.org/stable/c/67fad724f1b568b356c1065d50df46e6b30eb2f7
• https://git.kernel.org/stable/c/70882d7fa74f0731492a0d493e8515a4f7131831
• https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html