REDHAT-BUG-2334548: Medium severity Linux Foundation Linux Kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix UAF via mismatching bpfprog/attachment RCU flavors
Uprobes always use bpfprogrunarrayuprobe() under tasks-trace-RCU protection. But it is possible to attach a non-sleepable BPF program to a uprobe, and non-sleepable BPF programs are freed via normal RCU (see bpfprogputnoref()). This leads to UAF of the bpfprog because a normal RCU grace period does not imply a tasks-trace-RCU grace period.
Fix it by explicitly waiting for a tasks-trace-RCU grace period after removing the attachment of a bpfprog to a perfevent.
Affected Software
Event History
Frequently Asked Questions
What configuration is exposed to this use-after-free condition?
Systems are exposed when a non-sleepable BPF program is attached to a uprobe. Uprobes execute attached programs under tasks-trace-RCU protection, while non-sleepable BPF programs are freed using normal RCU.
What event triggers the unsafe lifetime condition?
The issue occurs after a BPF program attachment is removed from a perf event: normal RCU reclamation can free the program before a tasks-trace-RCU grace period has completed, allowing a uprobe path to access freed memory.
What does the resolved kernel change do?
The fix explicitly waits for a tasks-trace-RCU grace period after removing a BPF program attachment from a perf event. This ensures uprobe execution paths cannot retain access to the program when it is freed.