In the Linux kernel, the following vulnerability has been resolved: uprobe: avoid out-of-bounds memory access of fetching args Uprobe needs to fetch args into a percpu buffer, and then copy to ring buffer to avoid non-atomic context problem. Sometimes user-space strings, arrays can be very large, but the size of percpu buffer is only page size. And store_trace_args() won't check whether these data exceeds a single page or not, caused out-of-bounds memory access. It could be reproduced by following steps: 1. build kernel with CONFIG_KASAN enabled 2. save follow program as test.c ``` \#include <stdio.h> \#include <stdlib.h> \#include <string.h> // If string length large than MAX_STRING_SIZE, the fetch_store_strlen() // will return 0, cause __get_data_size() return shorter size, and // store_trace_args() will not trigger out-of-bounds access. // So make string length less than 4096. \#define STRLEN 4093 void generate_string(char *str, int n) { int i; for (i = 0; i < n; ++i) { char c = i % 26 + 'a'; str[i] = c; } str[n-1] = '\0'; } void print_string(char *str) { printf("%s\n", str); } int main() { char tmp[STRLEN]; generate_string(tmp, STRLEN); print_string(tmp); return 0; } ``` 3. compile program `gcc -o test test.c` 4. get the offset of `print_string()` ``` objdump -t test | grep -w print_string 0000000000401199 g F .text 000000000000001b print_string ``` 5. configure uprobe with offset 0x1199 ``` off=0x1199 cd /sys/kernel/debug/tracing/ echo "p /root/test:${off} arg1=+0(%di):ustring arg2=\$comm arg3=+0(%di):ustring" > uprobe_events echo 1 > events/uprobes/enable echo 1 > tracing_on ``` 6. run `test`, and kasan will report error. ================================================================== BUG: KASAN: use-after-free in strncpy_from_user+0x1d6/0x1f0 Write of size 8 at addr ffff88812311c004 by task test/499CPU: 0 UID: 0 PID: 499 Comm: test Not tainted 6.12.0-rc3+ #18 Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x55/0x70 print_address_description.constprop.0+0x27/0x310 kasan_report+0x10f/0x120 ? strncpy_from_user+0x1d6/0x1f0 strncpy_from_user+0x1d6/0x1f0 ? rmqueue.constprop.0+0x70d/0x2ad0 process_fetch_insn+0xb26/0x1470 ? __pfx_process_fetch_insn+0x10/0x10 ? _raw_spin_lock+0x85/0xe0 ? __pfx__raw_spin_lock+0x10/0x10 ? __pte_offset_map+0x1f/0x2d0 ? unwind_next_frame+0xc5f/0x1f80 ? arch_stack_walk+0x68/0xf0 ? is_bpf_text_address+0x23/0x30 ? kernel_text_address.part.0+0xbb/0xd0 ? __kernel_text_address+0x66/0xb0 ? unwind_get_return_address+0x5e/0xa0 ? __pfx_stack_trace_consume_entry+0x10/0x10 ? arch_stack_walk+0xa2/0xf0 ? _raw_spin_lock_irqsave+0x8b/0xf0 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? depot_alloc_stack+0x4c/0x1f0 ? _raw_spin_unlock_irqrestore+0xe/0x30 ? stack_depot_save_flags+0x35d/0x4f0 ? kasan_save_stack+0x34/0x50 ? kasan_save_stack+0x24/0x50 ? mutex_lock+0x91/0xe0 ? __pfx_mutex_lock+0x10/0x10 prepare_uprobe_buffer.part.0+0x2cd/0x500 uprobe_dispatcher+0x2c3/0x6a0 ? __pfx_uprobe_dispatcher+0x10/0x10 ? __kasan_slab_alloc+0x4d/0x90 handler_chain+0xdd/0x3e0 handle_swbp+0x26e/0x3d0 ? __pfx_handle_swbp+0x10/0x10 ? uprobe_pre_sstep_notifier+0x151/0x1b0 irqentry_exit_to_user_mode+0xe2/0x1b0 asm_exc_int3+0x39/0x40 RIP: 0033:0x401199 Code: 01 c2 0f b6 45 fb 88 02 83 45 fc 01 8b 45 fc 3b 45 e4 7c b7 8b 45 e4 48 98 48 8d 50 ff 48 8b 45 e8 48 01 d0 ce RSP: 002b:00007ffdf00576a8 EFLAGS: 00000206 RAX: 00007ffdf00576b0 RBX: 0000000000000000 RCX: 0000000000000ff2 RDX: 0000000000000ffc RSI: 0000000000000ffd RDI: 00007ffdf00576b0 RBP: 00007ffdf00586b0 R08: 00007feb2f9c0d20 R09: 00007feb2f9c0d20 R10: 0000000000000001 R11: 0000000000000202 R12: 0000000000401040 R13: 00007ffdf0058780 R14: 0000000000000000 R15: 0000000000000000 </TASK> This commit enforces the buffer's maxlen less than a page-size to avoid store_trace_args() out-of-memory access.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5818 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5818-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     November 24, 2024                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2022-45888 CVE-2023-52812 CVE-2024-26952 CVE-2024-26954                      CVE-2024-35964 CVE-2024-36244 CVE-2024-36478 CVE-2024-36914                      CVE-2024-36915 CVE-2024-36923 CVE-2024-38540 CVE-2024-38553                      CVE-2024-41080 CVE-2024-42322 CVE-2024-43868 CVE-2024-43904                      CVE-2024-43911 CVE-2024-44949 CVE-2024-49950 CVE-2024-49960                      CVE-2024-49974 CVE-2024-49986 CVE-2024-49991 CVE-2024-50012                      CVE-2024-50036 CVE-2024-50067 CVE-2024-50072 CVE-2024-50126                      CVE-2024-50215 CVE-2024-50218 CVE-2024-50228 CVE-2024-50229                      CVE-2024-50230 CVE-2024-50232 CVE-2024-50233 CVE-2024-50234                      CVE-2024-50235 CVE-2024-50236 CVE-2024-50237 CVE-2024-50242                      CVE-2024-50243 CVE-2024-50244 CVE-2024-50245 CVE-2024-50247                      CVE-2024-50249 CVE-2024-50250 CVE-2024-50251 CVE-2024-50252                      CVE-2024-50255 CVE-2024-50256 CVE-2024-50257 CVE-2024-50259                      CVE-2024-50261 CVE-2024-50262 CVE-2024-50264 CVE-2024-50265                      CVE-2024-50267 CVE-2024-50268 CVE-2024-50269 CVE-2024-50271                      CVE-2024-50272 CVE-2024-50273 CVE-2024-50276 CVE-2024-50278                      CVE-2024-50279 CVE-2024-50280 CVE-2024-50282 CVE-2024-50283                      CVE-2024-50284 CVE-2024-50286 CVE-2024-50287 CVE-2024-50290                      CVE-2024-50292 CVE-2024-50295 CVE-2024-50296 CVE-2024-50299                      CVE-2024-50301 CVE-2024-50302 CVE-2024-53042 CVE-2024-53043                      CVE-2024-53052 CVE-2024-53054 CVE-2024-53055 CVE-2024-53057                      CVE-2024-53058 CVE-2024-53059 CVE-2024-53060 CVE-2024-53061                      CVE-2024-53063 CVE-2024-53066 CVE-2024-53070 CVE-2024-53072                      CVE-2024-53081 CVE-2024-53082 CVE-2024-53088 CVE-2024-53093

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the stable distribution (bookworm), these problems have been fixed in     version 6.1.119-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CVE-2024-50067

high

Tenable Plugins

high