In the Linux kernel, the following vulnerability has been resolved: futex: Clear stale exiting pointer in futex_lock_pi() retry path Fuzzying/stressing futexes triggered: WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524 When futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY and stores a refcounted task pointer in 'exiting'. After wait_for_owner_exiting() consumes that reference, the local pointer is never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a different error, the bogus pointer is passed to wait_for_owner_exiting(). CPU0 CPU1 CPU2 futex_lock_pi(uaddr) // acquires the PI futex exit() futex_cleanup_begin() futex_state = EXITING; futex_lock_pi(uaddr) futex_lock_pi_atomic() attach_to_pi_owner() // observes EXITING *exiting = owner; // takes ref return -EBUSY wait_for_owner_exiting(-EBUSY, owner) put_task_struct(); // drops ref // exiting still points to owner goto retry; futex_lock_pi_atomic() lock_pi_update_atomic() cmpxchg(uaddr) *uaddr ^= WAITERS // whatever // value changed return -EAGAIN; wait_for_owner_exiting(-EAGAIN, exiting) // stale WARN_ON_ONCE(exiting) Fix this by resetting upon retry, essentially aligning it with requeue_pi.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d2424537380> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23beb16840> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23bea8b900> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d239fbdc280> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d2424535900> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d2424537bc0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23beb14900> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d242455e040> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d25cf3df100> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d2424536840> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23beb179c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d242455d600> | Operating System |
| linux | linux_kernel | 5.5 | <built-in method update of dict object at 0x7d239fbde300> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d23beb16580> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d242455d980> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d2424535880> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d23beb15e80> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d24246c3f40> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d2424534d00> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d2424671f80> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.5:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* |