CVE-2024-56675

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors

Uprobes always use bpf_prog_run_array_uprobe() under tasks-trace-RCU protection. But it is possible to attach a non-sleepable BPF program to a uprobe, and non-sleepable BPF programs are freed via normal RCU (see __bpf_prog_put_noref()). This leads to UAF of the bpf_prog because a normal RCU grace period does not imply a tasks-trace-RCU grace period.

Fix it by explicitly waiting for a tasks-trace-RCU grace period after removing the attachment of a bpf_prog to a perf_event.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/9245459a992d22fe0e92e988f49db1fec82c184a
• https://git.kernel.org/stable/c/9b53d2c2a38a1effc341d99be3f99fa7ef17047d
• https://git.kernel.org/stable/c/ef1b808e3b7c98612feceedf985c2fbbeb28f956
• https://git.kernel.org/stable/c/f9f85df30118f3f4112761e6682fc60ebcce23e5
• https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html